The NAS is on and off, and arp -a found that two devices are grabbing the same IP.
What’s even more strange is the screenshot he sent: There is an alarm popping up in the upper right corner of the Synology backend, "Network IP conflict detected." These eight characters are the direction of solving the case. I asked him to knock twice arp -a , post the two outputs to me, and I can see the problem at a glance.: same one 192.168.0.30 , the MAC addresses of the two records are different. I don’t know when there was an extra device at home, and it was competing for the same house number as the NAS.
This article will explain clearly the ARP behind this matter. It is the most basic link in the network. I wrote before What is a MAC address and What does the subnet mask control? I have been walking around it all the time, but this time it is clear from the front - because of strange problems such as IP conflicts, intermittent connectivity, and loss of connection after changing devices, the root cause of the problem is nine out of ten.
Make it clear first: ARP is the cry of exchanging IP for MAC.
Let’s continue with the community metaphor in the masking article. The mask circles your community (network segment), The gateway is the gate of the community , and to find people within the community, you rely on "just shouting."
The scene is like this: Your computer needs to be given 192.168.0.30 Send data. The IP address is a house number used by people, but when it is actually packaged and shipped on the Internet, what is written on the envelope is the MAC address - the physical number of the device's network card. Here comes the problem: The computer only knows the house number, but does not know what the person living under the house number looks like.
ARP (Address Resolution Protocol) does this translation work. The computer first broadcasts in the community and shouts: 「who is 192.168.0.30 ? Please reply! 」This voice can be heard by every device in the community. The address is really your own device that responds: 「I am 192.168.0.30 , my MAC is 00-11-32-xx. 」Over and over again, the computer records this correspondence in a small notebook, and then the letter is sent according to the MAC. There is no need to shout again when communicating in the future.
That little notebook is ARP cache table . It is the most worth considering part of the ARP protocol: Shouting (broadcasting) is very noisy, and the whole community has to stop what they are doing to listen to you shouting, so the protocol is designed to "shout once and write it down, and if you can do it without shouting, don't shout." The mystery behind why IP conflicts appear to be on and off lies in the refresh mechanism of this table. See below.
That night at my cousin's house: After two arp -a attempts, MAC changed people under their noses.
Return to the crime scene. My cousin's NAS is a fixed IP that was manually set according to the tutorial during installation. 192.168.0.30 , filled in the settings panel, and the router was unaware of the entire process. A while ago, he replaced the TV box with a new one, plugged in the Internet cable, and DHCP automatically obtained the address - the router saw that .30 was empty in the address pool (it really didn't know that it was manually occupied by the NAS), and generously gave it to the box.
So there were two families living under the same house number. The computer shouted "Who is .30", and both the NAS and the box responded. The computer's notebook recorded the MAC of the NAS for a while, and the MAC of the box for a while. When sending files, the MAC written on the envelope pointed to the NAS and the data was delivered smoothly. ； The next time the stopwatch was erased by the box's response, the envelope pointed to the box. When the box saw that the recipient was not him, he threw it away. This is the whole mechanism of "on and off" - it's not that the line is congested, it's that the recipient is changing.
The verification method is the two steps I asked him to do. first time:
arp -a
interface: 192.168.0.108 --- 0x5
192.168.0.30 00-11-32-6a-4c-21 News
192.168.0.1 d8-5d-84-3f-90-77 dynamics
After typing again every ten seconds, the .30 line becomes another MAC starting with 50-e2-f5. 00-11-32 is the manufacturer prefix of Synology network card, and 50-e2 indicates which box it belongs to. MAC changes its owner every ten seconds, which is more straightforward than any other troubleshooting. By the way, you should also pay attention to the MAC corresponding to line .1 on the router. It will be used when troubleshooting network corruption and ARP spoofing.
Just three steps to process: Power off the box or disconnect it from the Internet first, and the NAS will return to stability immediately. ； Then go into the backend of the router and remove .30 from the DHCP address pool, or simply statically bind both the NAS and the box.—— Static IP binding article I wrote the complete method, the core is just one sentence: The manually set IP must be known to the router, either filled in outside the pool, or directly bound to the router, so that DHCP does not have the opportunity to assign it. My cousin later tied .30 to the NAS in the router, and changed the box to automatically pick it up via DHCP, and everything has been fine ever since. This also explains why DHCP address pool It is often recommended to leave a section open - just to make room for manual equipment.
How to read the output of arp -a: Each of the three columns has its own use
on Windows arp -a What is listed is the current ARP table of this machine. All three fields are worth knowing.:
| Field | what is | What to look for during investigation |
|---|---|---|
| Internet address | The IP of the other device | Is there any unfamiliar IP (clues from Internet surfing)? |
| physical address | Corresponding MAC | The MAC of the same IP has not changed (actual conflict) ； The top six searchable manufacturers of MAC |
| type | dynamic/static | Dynamics are learned automatically, statics are tied manually. |
Don't ignore the interface line, it tells you which network card this table is hung on. After a virtual machine or VPN is installed on the computer, there will be several more virtual network cards. Each network card has its own independent ARP table. If you read the wrong interface, you will get the misjudgment that "there is no other party in the table" - in fact, you are checking the wrong notebook.
The commands on Mac and Linux are different but the same thing: Mac is arp -a , Linux can ip neigh , the output includes IP, MAC and status. If you see FAILED or INCOMPLETE in the status column, it means that no one answered the call - the other party has shut down, or is not in this network segment at all.
To clear cache arp -d , followed by IP to delete a single entry, followed by an asterisk to clear all. For this command on Windows, you need to open cmd as an administrator. If you have normal permissions, access will be denied. When do I need to clean it manually? After the network card of the device was changed and the network port was moved, some machines were unable to connect. First, ipconfig /flushdns Clear the domain name cache, and then arp -d * Clear it once and let the computer speak again one by one. Many "metaphysical disconnections" will heal themselves at this point.
Windows pops up "IP address conflict", it's Free ARP alarming
Behind the alarm displayed by Synology in my cousin's screenshot is a mechanism called "Free ARP", which is also the "IP address conflict detected" pop-up window in Windows.
When a device is equipped with an IP and ready to go online, it will first ask and answer questions.: 「who is 192.168.0.30 ? 」——The point is, it is 192.168.0.30 . Under normal circumstances, no one would answer this strange call, so it went online safely. But if this address is already occupied by someone else, and the person who occupies it looks at "This is my address, who is asking?" and replies "I am", the new device will immediately understand that the address is blocked, Windows will pop up a conflict warning on the spot, and Synology will hang an alarm in the background. It is all at this moment.
This self-questioning and self-answering also has an incidental benefit.: After hearing it, the whole community will update this record in the notebook to the new MAC of the caller. Therefore, when a new router is replaced or the network card of the device is changed, there is usually no need to clear the cache on each machine. As soon as the new device goes online and broadcasts once, everyone's tables will be refreshed. What really cannot be erased is my cousin’s tug-of-war of “both devices using free ARP to declare the same IP” – you swipe it once and I swipe it again, so the ARP table changes that night.
When will the number be automatically bumped? The three most common: Manually set the IP into the DHCP pool (my cousin’s model) ； Both devices have been manually set to the same IP ； After the router was powered off and restarted, the DHCP records were lost and the addresses in use were reassigned. The first two are configuration issues, and the third occurs occasionally on old routers.—— Restart the router regularly That article mentioned that status is lost after power outage. Address allocation records are one of the lost things. Static binding of important equipment can avoid most of them.
The IP/MAC binding in the router is in the same family as ARP
If you look through the backend of the router, you will find a function called "IP and MAC binding", or "static ARP" or "ARP binding". There are various names, but they are all based on the ARP table of the router.
The router itself also maintains an ARP table - the "device name + IP + MAC" in the background device list. A large part of it is the learning result of this table. Every connected device has called and responded, and it has been recorded. When compared with the DHCP lease record, it becomes the list you see. Some old routers do not display the device name in the background, but only give a string of MAC, which is the most original appearance.
「"Binding" means picking a few records and nailing them. After crucifixion, it has two uses: The first layer is fixed IP allocation (DHCP static lease), the address no longer drifts, port forwarding When you point to a fixed address for remote access, all the rules will be invalidated if the IP changes. ； The other layer is security. After the gateway record is tied up, someone in the LAN forges the gateway MAC and sends a fake response (an old trick of ARP spoofing), and the router will not admit it. The first layer of the home scene is just necessary, and the second layer is the icing on the cake.
There is also an unpopular usage in reverse: When the device is turned off, it does not respond to ARP. . written before Remote power on I encountered this pitfall when the router wanted to transfer the magic packet coming in from the outside to the home computer. I checked the ARP table and found that the record of this computer had expired long ago. No one answered the call, so I had to throw away the packet when it arrived. Therefore, one of the prerequisite steps for remote booting is to bind the computer's IP/MAC in the router, so that this record will remain in the table forever. You see, the same mechanism can be used to prevent drift when used in reverse, but to maintain records when used in reverse.
Under what circumstances should we suspect ARP?
The troubles caused by ARP have several fixed faces, and they will be correct when encountering them.:
| symptom | ARP level explanation | What to do first |
|---|---|---|
| Ping is on and off, with random patterns. | IP conflict, two MACs take turns to flush the table | Type arp -a twice to see that the MAC remains unchanged. |
| "IP address conflict"」 | Free ARP detected number collision | Find two devices and change their addresses or bind them |
| Some machines cannot connect after changing the network card/router. | The old cache still points to the old MAC | arp -d * Clean up the list and re-study |
| There is a strange IP in arp -a | The table is the bottom layer of the device list | Check the top six manufacturers of MAC. If you don’t agree, check the website. |
| There is no counterparty at all | No one answered when I shouted: Different network segments or the other party shuts down | Check the mask and gateway first, then check whether the other party is alive or dead. |
Give one order of investigation: First ping Distinguish between continuity and disconnection, and then arp -a Look at the watch and then use arp -d Clear it and try again, and finally it’s your turn to reboot the device. Most "metaphysical network problems" manifest themselves in the first three steps. Restarting is both a great and a lazy move - it will indeed clear the ARP table, so most of the problems that "restart will be cured" are rooted in this table. Just restarting will never tell you why.
My cousin’s NAS is now very stable. He later told me the truth.: In the past, I always thought that the Internet was either connected or not, a black and white matter. After struggling all night, I realized that there is an area in the middle where the network is always connected and sometimes disconnected, and that area is basically managed by ARP.
