Skip to content

Symptoms: ARP Flux / Duplicate IP

  • Server app-web-05 (10.30.1.100) experiences intermittent connectivity loss lasting 10-30 seconds at a time.
  • During outages, some clients can reach the server while others cannot.
  • The problem occurs randomly, sometimes multiple times per hour, sometimes not for hours.
  • Running arp -a on a client shows the MAC address for 10.30.1.100 changing between two different values.
  • The server team has verified that app-web-05's NIC MAC is 00:1a:2b:3c:4d:5e.
  • The second MAC appearing in ARP tables is 00:ff:aa:bb:cc:11, which does not match any known server in the CMDB.
  • The DHCP server logs show two active leases for 10.30.1.100.
  • A developer recently brought up a test VM and "picked an IP that looked free" from the subnet.