hey,

i have mounted a debian server that serve some clients, where i use dhcp and mac/ip filltering.

Now i monitor eventual mac spoofing with arp watch on those interfaces.
I have 2 interfaces to LAN clinets, and one to WAN.

i've noticed a log from arpwatch , saying something like :

arpwatch: flip flop 10.0.0.1 0:1b:21:e:54:b1 (0:1b:21:e:5b:49) eth1
arpwatch: flip flop 10.0.0.1 0:1b:21:e:5b:49 (0:1b:21:e:54:b1) eth1
arpwatch: flip flop 10.0.0.1 0:1b:21:e:54:b1 (0:1b:21:e:5b:49) eth1
arpwatch: flip flop 10.0.0.1 0:1b:21:e:5b:49 (0:1b:21:e:54:b1) eth2
arpwatch: flip flop 10.0.0.1 0:1b:21:e:5b:49 (0:1b:21:e:54:b1) eth1

ip 10.0.0.1 is only for example and is attached to eth1 (/24 class).
the first mac "00:1b:21:03:54:b1" is for eth2 , and the other "00:1b:21:0e:5b:49" for eth1.

Now what that say bothers me ... something like "eth2" borrows "eth1" ip's for a while.

any ideea of what could tirgger this ?!