system log question about frequent message

[knussear]

hi all

I've searched around but can't seem to find an answer about this one.

I was browsing my system log and I get lots of this message over and over.

Does anyone know what it means?

Thanks

Ken

Apr 6 14:43:31 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 14:43:31 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0
Apr 6 14:48:14 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 14:48:14 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0
Apr 6 14:48:45 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 14:48:46 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0
Apr 6 14:50:45 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 14:50:46 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0
Apr 6 14:52:46 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 14:52:46 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0
Apr 6 14:52:54 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 14:52:54 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0
Apr 6 14:54:46 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0
Apr 6 14:55:31 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 14:55:31 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0
Apr 6 14:56:19 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 14:56:19 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0
Apr 6 15:02:59 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 15:02:59 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0
Apr 6 15:03:14 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 15:03:14 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0

 

[Jrstasko]

I could be wrong but I am almost positive that is your mac address changing on the last set of numbers or characters because the first address is an ip, do you have something changing your mac addy? Sorry for the lack of a better response.

 

[ElDiabloConCaca]

Do you know who 130.118.68.35 belongs to or who they are? "ARP" is "Address Resolution Protocol" and is used to find other computers on an IPv4 network (the Internet). What the message is saying is that 130.118.68.35 is no longer on the network at 00:11:43:ee:95:ca and is now at the network at 00:11:43:ee:95:ca. Your computer seems to be flipping back and forth between the two for some reason.

Do you have any Sharing features enabled in your System Preferences? Are you running any kind of network applications? A web server? A file server? Please describe your setup and scenario in some detail, especially the network and how it's set up.

 

[macbri]

hi all

Apr 6 15:02:59 Whiplash kernel[0]: arp: 130.118.68.35 moved from 00:11:43:ee:95:ca to 00:11:43:ee:95:cb on en0
Apr 6 15:02:59 Whiplash kernel moved from 00:11:43:ee:95:cb to 00:11:43:ee:95:ca on en0

Apple's airport express uses the 00:11: MAC address range. And since the two MAC addresses differ by one byte, that implies it's the ethernet port and wireless on the same airport express device. Also, ethernet device en0 is the ethernet card in your macintosh (usually). So is 'Whiplash' connected via ethernet to the airport express (perhaps via a router or switch ot hub), as well as wirelessly? That might explain what you're seeing. Another possibility is that your mac Whiplash is connected to a switch/hub/router which connects directly or indirectly to your airport express both over ethernet cable, and wirelessly.

 

[knussear]

Well its happening at work, and there is no wireless there. It could have been that I had the location set to automatic and that was causing some trouble?

130.118.68.35 is one of the servers there, probably the DHCP server.

We are running a DHCP ip assignment.

I have no shares, ftp, ssh, telnet, or webserver running.

 

[macbri]

Oooh, I struck out! The fact that the two MAC addresses are only one byte off does seem significant though - maybe the server has two network interfaces and the same IP assigned to both or something like that?