At 03:50 PM 1/14/2013, James Harper wrote:

Happens more commonly now when virtual machines are incorrectly cloned, and yeah it's really strange the first time you see it. looking through the arpwatch logs lets you know what's going on pretty quickly though.

Yep, cloned VMs can certainly cause duplicate MAC addresses on their virtual Ethernet interfaces. Haven't had that issue, because I run VMware, and it is good at detecting when you've moved or copied a VM, and recommends you to say "I copied this VM" if you're not sure. I was debugging the MAC address issue over 10 years ago on a mostly Windows network. We had some IP, as well as Novell IPX/SPX, and a couple of Linux boxes, mostly (all?) in the DMZ, which wouldn't have helped with the troubleshooting. I had to logically deduce what was going on, and duplicate MAC addresses ended up being the only logical possibility (which was proved), after checking that the (Windows) DHCP server was working correctly and ruling out other possibilities. 73 de VK3JED / VK3IRL http://vkradio.com