One IP address has multiple MAC addresses, how is this possible?

While looking for duplicate addresses with the following command, "arp-scan --timeout 1000 192.168.110.0/24", I discovered that the host I'm running this command on has multiple MAC addresses for the same IP address.

192.168.110.200 00:90:e8:64:0f:a7       MOXA TECHNOLOGIES CORP., LTD.
192.168.110.200 00:90:e8:64:0f:a9       MOXA TECHNOLOGIES CORP., LTD. (DUP: 2)
192.168.110.200 00:90:e8:64:0f:a5       MOXA TECHNOLOGIES CORP., LTD. (DUP: 3)
192.168.110.200 00:90:e8:64:0f:ab       MOXA TECHNOLOGIES CORP., LTD. (DUP: 4)
192.168.110.200 00:90:e8:64:0f:9b       MOXA TECHNOLOGIES CORP., LTD. (DUP: 5)
192.168.110.200 00:90:e8:64:0f:af       MOXA TECHNOLOGIES CORP., LTD. (DUP: 6)

Note that 192.168.110.200 is the Linux host from which I am running the command. Additionally, I have 35 other cloned hosts that are in identical isolated networks and I am not seeing this behaviour.

I am starting to think this is hardware problem.


it seems to me that you are dealing with an ARP flux. If your Linux host has many Ethernet interfaces on the same subnet then your host replies to ARP requests for interfaces on the same subnet, from any interface on that same subnet.

Starting from kernel 2.6.4, the default behavior of the Linux kernel can be corrected with the two following commands:

$ sysctl -w net.ipv4.conf.all.arp_announce=1
$ sysctl -w net.ipv4.conf.all.arp_ignore=2