Arpwatch - sent wrong arp op 5

AlexanderK

I have two mac addresses - belong to chinese cameras that make a lot of noise on system log.

I have the mac addresses suppressed

But still receiving those annoying notifications.

Can anyone help?

tinfoilmatt

@AlexanderK Do you have the setting "Zero padded ethernet addresses" checkbox checked? If not, check it and restart arpwatch.

AlexanderK

@tinfoilmatt said in Arpwatch - sent wrong arp op 5:

@AlexanderK Do you have the setting "Zero padded ethernet addresses" checkbox checked? If not, check it and restart arpwatch.

It is already checked.

tinfoilmatt

@AlexanderK Can you post a screenshot of your full arpwatch settings?

Looking at the arpwatch man page—and it's not clear that this sent wrong arp op 5 syslog message is a 'supressable' report, or even a report message at all.

AlexanderK

@tinfoilmatt said in Arpwatch - sent wrong arp op 5:

@AlexanderK Can you post a screenshot of your full arpwatch settings?

Looking at the arpwatch man page—and it's not clear that this sent wrong arp op 5 syslog message is a 'supressable' report, or even a report message at all.

Yes here it is

dennypage

Arpwatch has no way to suppress protocol errors such as this. ANDwatch, a pending package to replace the Arpwatch package, allows suppression by way of pcap filtering.