I have an Copper pipe which includes 60 usable Public IP Addresses. Maybe 20 of them are actually in use; lets say 10.0.0.2 - 10.0.0.22 ( using local IPs for security ) I am currently getting intermittent connectivity on my network. I assigned my laptop 10.0.0.2 and all other routers are assigned 10.0.0.x if x > 2 && x <=22 I am pinging the HP1810 switch, 10.0.0.3, and one router, 10.0.0.4. I am also pinging the Main Router IP, 10.0.0.1, the WAN serial IP, 192.0.0.1 and DNS, 4.2.2.2 From External I am pinging 10.0.0.3 and 192.0.0.1 When the issue occurs, I lose packets on my internal ping ONLY to 10.0.0.1, 192.0.0.1, 4.2.2.2. I do not lose packets on internal pinging to 10.0.0.3, 10.0.0.4, nor do the external pings show dropped packets. It appears that something is clogging things up such as a broadcast, loop, or duplicate IP addresses. I troubleshooted by running wireshark from my laptop on 10.0.0.2. I then ran an ipscanner to the subnet to get the ARPs back from them. When I apply filter : expert.message contains "Duplicate IP address" I see a lot of
Now the MAC address xx:... correlates to a Sonicwall TZ-215 and z has been 10 different IPs and yy:... mac address has been 10 different MACs. Is this what is causing my issues? the Sonicwall somehow fixing itself to multiple IP address on the subnet? I also received the following:
and
Now the Dell with yy:... MAC address is my laptop that sent out the ipscan and the Cisco xx:... is presumably a router with the ip address 10.0.0.15 What is that about as well? Thanks for the help peoples!! asked 14 Aug '12, 11:57 eherr9633 |
One Answer:
Sounds like the SonicWall is doing Proxy ARP for parts of the network. This can be caused by
If the SonicWall is not configured for bridging, I suggest to look for any "strange" NAT rules, that don't make any sense in your environment. Think TWICE, then disable them. Then clear the ARP cache on your test system and try again. Regards answered 14 Aug '12, 16:18 Kurt Knochner ♦ |