Tom, This event is generated by HP OpenView when it detects a suspect physical address (sometimes called MAC address or link level address) on a node. This happens when the physical address from node2's ARP cache is different than what node1 returned via SNMP. The physical address from node2 is discarded.
This could be caused by a stale ARP cache entry, if node1's physical address recently changed. However, if the physical address on node1 has not changed due to a change in node1's physical address (such as interface card replaced or machine upgraded), this could represent a duplicate IP address, so this event should be closely watched.
The ARP cache on node2 could be different because nodeX is also using node1's IP address, and node2 has most recently talked to nodeX.
To get more information, two nodes need to be queried. The first node is the node which reported a different physical address. This information was retrieved from the first node's ARP cache.
The other part of the information needed is to get the physical address for the node in question. This information was retrieved from the second node's IfPhysAddress.
The first part of the information needed (ARP Cache) can be retrieved by selecting the first node then using the menuitem: Configuration:Network Configuration->ARP Cache or the TTY command: snmpwalk 126.96.36.199.188.8.131.52.1.2. It can also be determined by selecting mgmt.mib-2.at.atTable.atEntry.atPhysAddress from the MIB browser and SNMP walking the first node. These will all return the ARP Cache. You must find the entry which corresponds to the second node.
The second part of the information needed (physical address) can be retrieved using the menu item: Configuration:Network Configuration->Addresses or the TTY command: snmpwalk 184.108.40.206.220.127.116.11.1.6. It can also be determined by selecting mgmt.mib-2.interfaces.ifTable.ifEntry.ifPhysAddress from the MIB browser and SNMP walking the second node.
If there truly is a mismatch, it can be caused by one node using the same IP address as another. The message may also indicate that an IP address is using two different physical addresses. This happens when the IP address of a node changes because that node has changed subnets. Yet another problem comes from older HP X-Terminal firmware which incorrectly reported an ifPhysAddress of 00 00 00 00 00 00.
Typically, several nodes will report this mismatch during ademand poll operation, or as they do their daily configuration checks. Berlene