Home / server / Questions / 314888
Accepted
Jeremy Friesner
Asked: 2011-09-24 07:48:04 +0800 CST

iPads cause arp-scan duplicate reports, why?

  • 772

I have a situation like this:

  1. Isolated Gigabit Ethernet LAN with a handful of Linux boxes and Macs on it
  2. Airport Extreme wireless access point is also connected to the LAN
  3. Two iPads talking to the system via the Airport Extreme and Wifi
  4. The iPads are set to use static IP address settings. One iPad is set to IP address 192.168.8.38 and the other is set to 192.168.8.39.
  5. One of the Linux boxes periodically runs arp-scan and reports if any duplicate IP addresses are present on the LAN.

The issue is that sometimes (not always), the arp-scan process will report that both iPads' MAC addresses are using the same IP address. When this happens, arp-scan's output shows both iPad's MAC addresses associated with IP address 192.168.8.39. (This despite us manually verifying that the two iPads have distinct IP addresses and MAC addresses by looking at their network settings pages on-screen)

Other than this report from arp-scan, communication with the iPads appears to work fine.

Does anyone know what might cause this behavior? All I can think of is that the iPads' MAC addresses might be hashed to the same value somehow and thus they are overwriting each other in some data structure... or that the iPad set to address 192.168.8.38 occasionally "wanders over" and uses the address next door instead, despite being set to a static IP address. Neither of those hypotheses seems very likely to me though. :^(

arp ipad duplicate-ip

2 Answers

  1. Best Answer

    This seems to be a case of Apple Sleep Proxy Service.

    http://en.m.wikipedia.org/wiki/Sleep_Proxy_Service

    "When a Sleep Proxy sees an IPv4 ARP or IPv6 ND Request for one of the sleeping device's addresses, it answers on behalf of the sleeping device, without waking it up, giving its own MAC address as the current (temporary) owner of that address."

    • 3

  2. An ARP scan typically works by sending an ARP request to every ip address in a particular subnet, so I don't see how it's likely that the MAC addresses are being hashed (I'm not even sure what that means) and I don't think it's a caching issue as I'm assuming the machine initiating the ARP scan doesn't use it's own ARP cache during the scan and if it does that it flushes it prior to the scan.

    The only thing I can think of is that the WAP is performing some type of proxy ARP for the connected clients?

    • 2