Alert unexpected packets.

[Evert]

We have some devices for building management, which are connected to the internet via our MX-84. In the logging I see a lot of alerts"Client: 10.10.1.156, MAC: AC:CC:8E:8E:7B:12, VLAN: 2, details: sent 129700 unexpected packets (Last seen packet IP=169.254.164.225)". 

What does this mean?

[RaphaelL]

Hi,

this is the IP spoofing kicking in : https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/IP_Source_Address_Spoofing_Protecti...

[Evert]

Hi,

Thanks for answering, you mean both IP addresses, 10.10.1.156 and the (Last seen packet IP=169.254.164.225) are both in use on the device?

[RaphaelL]

Probably that the device with MAC XXXXXXXX is sourcing packets with the IP 169.254.164.225 which is not a valid IP for vlan '2'

[Brash]

It looks like the MX 84 has registered (either assigned from its own DHCP pool or other) that the MAC address should match IP address 10.10.1.156.

However, the client does not have that IP address and is sending DHCP requests (hence the 169.254.164.225 IP address).

[Isigma]

The MAC in question belongs to AXIS Communication device (a security camera or a door access unit). AXIS by default has "link-local" or "fallback" IP address setting turned on. This means, unless that feature turned off, the device periodically advertises its self-assigned backup IP address, and ready to use as a main address it in case DHCP server is not present on the network. That address is in APIPA range 169.254.x.x. 
Since the DHCP or statically assigned main IP address and this fallback address are coming from the same device, Meraki catches that subnet mismatch in the logs. It is harmless, but you can turn off fallback setting on the camera, and it will stop appearing in the logs.