For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Brandon_W_14724's avatar
Brandon_W_14724
Icon for Nimbostratus rankNimbostratus
Nov 26, 2014

ARP requests for 127.2.0.1

Our GTM (BIG-IP 11.4.1 Build 635.0 HF2) is constantly—several times a second—sending out ARP requests out the mgmt interface for the IP address 127.2.0.1 with a source address of 127.2.0.2. For examp...
BIG-IP DNS
network
What_Lies_Bene1's avatar
What_Lies_Bene1
Icon for Cirrostratus rankCirrostratus
Nov 27, 2014

127.2.0.2 is a local loopback address;

~  ip a s
1: lo:  mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/24 scope host lo
    inet 127.2.0.2/24 brd 127.2.0.255 scope host lo:1
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever

127.2.0.1 is the 'internal' SCCP IP address;

~  more /root/.ssh/known_hosts 
127.2.0.1,sccp ssh-rsa .....[edited]= SCCP server RSA2 key

So, perhaps your box has lost communication with the switch management subsystem (SCCP) for some reason? You could reset SCCP but this will no doubt lead to traffic loss so perhaps a full system reboot would be better, see here for more information:

">https://support.f5.com/kb/en-us/solutions/public/3000/400/sol3454.html" target="_blank">">https://support.f5.com/kb/en-us/solutions/public/3000/400/sol3454.html