Intermittent IP communication, two different MAC addresses showing

Any device with IP bound

A device is having intermittent trouble with IP communication to another device's IP address.  Sometimes it succeeds, but frequently it fails.

From a neighboring device on the same subnet as the "other device's IP address", sometimes ARP (Address Resolution Protocol) information shows one MAC address (aka Hardware Address) for the target IP, and sometimes it shows another.  For example, on Linux, ARP information (IP and MAC pairings) can be checked and may show up as follows:

At one time:

dp-sles15sp5:/var/log # cat /proc/net/arp
IP address       HW type     Flags       HW address            Mask     Device
192.168.1.59     0x1         0x2         24:ee:9a:aa:4e:5a     *        eth0

At another time:

dp-sles15sp5:/var/log # cat /proc/net/arp
IP address       HW type     Flags       HW address            Mask     Device
192.168.1.59     0x1         0x2         00:50:56:1b:94:33     *        eth0

Change the IP address which is bound at one of the target devices.  See the Cause section for more detail.

A duplicate IP address assignment is present on the subnet.

If a MAC address (Media Access Control, or Hardware address) which supposedly owns the IP is changing (as viewed from another host on the subnet), this means that two different devices are advertising ownership of the same IP address.  Any host or router on that subnet will use whichever hardware address they learned most recently.  Learned hardware (or MAC) addresses are typically cached for about 2 minutes.  It can take time and some coincidental network traffic (such as ARP announcements or queries) before one learned MAC address is replaced by another.

Devices on different subnets (i.e. with a router between them) do not learn MAC addresses of each other.  Instead, that communication will rely on the routers' knowledge of the MAC addresses.  Therefore, if the target IP is on another subnet from the machine which initiates the contact, ARP data will need to be obtained from some 3rd device which is connected to the target subnet.

In some cases, it is not clear which devices are involved in the duplication.  Usually one device is known, because the user or process trying to make the connection knows the hostname and the intended identity of the system it is trying to connect to.  The "other" device which also uses the same IP is often not readily known.  However, if the 2 intermittent MAC addresses are identified by repeated use of commands such as:

arp -a

ip neighbor

cat /proc/net/arp

Then the MAC addresses can be looked up online at a site such as:

https://macvendors.com/

This will show what hardware vendor or VM host vendor owns that MAC address, which might aid in identifying the rogue device.  Sometimes the vendor name will represent the maker of the entire device, though sometimes it only represents the maker of the NIC chipset.

Administrators may need to talk with those who run both devices, in order to settle the question of whose use of the IP address is legitimate.  Then one of the devices must be reconfigured to use another IP address.