Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a situation like this:

  1. Isolated Gigabit Ethernet LAN with a handful of Linux boxes and Macs on it
  2. Airport Extreme wireless access point is also connected to the LAN
  3. Two iPads talking to the system via the Airport Extreme and Wifi
  4. The iPads are set to use static IP address settings. One iPad is set to IP address and the other is set to
  5. One of the Linux boxes periodically runs arp-scan and reports if any duplicate IP addresses are present on the LAN.

The issue is that sometimes (not always), the arp-scan process will report that both iPads' MAC addresses are using the same IP address. When this happens, arp-scan's output shows both iPad's MAC addresses associated with IP address (This despite us manually verifying that the two iPads have distinct IP addresses and MAC addresses by looking at their network settings pages on-screen)

Other than this report from arp-scan, communication with the iPads appears to work fine.

Does anyone know what might cause this behavior? All I can think of is that the iPads' MAC addresses might be hashed to the same value somehow and thus they are overwriting each other in some data structure... or that the iPad set to address occasionally "wanders over" and uses the address next door instead, despite being set to a static IP address. Neither of those hypotheses seems very likely to me though. :^(

share|improve this question
up vote 3 down vote accepted

This seems to be a case of Apple Sleep Proxy Service.

"When a Sleep Proxy sees an IPv4 ARP or IPv6 ND Request for one of the sleeping device's addresses, it answers on behalf of the sleeping device, without waking it up, giving its own MAC address as the current (temporary) owner of that address."

share|improve this answer

An ARP scan typically works by sending an ARP request to every ip address in a particular subnet, so I don't see how it's likely that the MAC addresses are being hashed (I'm not even sure what that means) and I don't think it's a caching issue as I'm assuming the machine initiating the ARP scan doesn't use it's own ARP cache during the scan and if it does that it flushes it prior to the scan.

The only thing I can think of is that the WAP is performing some type of proxy ARP for the connected clients?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.