Symantec Messaging Gateway Machine Access Control (MAC) address is sending ARP queries or responses for Internet Protocol (IP) addresses other than what is assigned to the physical Network Interface Card (NIC).

Products

• Messaging Gateway

Issue/Introduction

Reviewing network packet traffic reveals that a Symantec Messaging Gateway (SMG) Network Interface Card's (NIC) Machine Address Control (MAC) is sending querying or responding for Internet Protocol (IP) addresses other than what is assigned to that NIC.

Notice that the MAC address is the same for requests from each NIC IP of a test SMG appliance:

Sender MAC address: Vmware_f9:31:73 (00:0c:29:f9:31:73)
Sender IP address: 10.168.17.137 (10.168.17.137)
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 10.168.17.140 (10.168.17.140)
   
Sender MAC address: Vmware_f9:31:73 (00:0c:29:f9:31:73)
Sender IP address: 10.168.17.138 (10.168.17.138)
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 10.168.17.140 (10.168.17.140)

Cause

This is due to the functionality of the underlying Linux kernel. The Linux kernel handles addressing, rather than the physical interfaces, since it controls each of the interfaces that can respond or query.

Resolution

The functionality does not cause issues in most environments. If you feel that there is a network issue due to this functionality, contact Symantec Technical Support for further assessment.