IPv4 address with different MAC

High Availability / Failover

Clustering, VRRP/HSRP, CARP, or other high-availability protocols use a virtual IP (VIP) shared between multiple nodes.

The active node advertises its MAC address for the shared IP. If failover happens, a different node advertises a new MAC.

Duplicate IP / Misconfiguration

Two or more hosts have accidentally been configured with the same IP address.

Both respond to ARP, so the IP flips between different MACs in the trace.

How to troubleshooting:

Look for VRRP/HSRP packets if it’s a gateway IP.

Look for routing path if asymmetric routing path exists (Egress packet routing path is not consistent with ingress packet routing path between two ipv4 endpoints.)