Arpwatch - sent wrong arp op 5
-
I have two mac addresses - belong to chinese cameras that make a lot of noise on system log.
I have the mac addresses suppressed
🔒 Log in to viewBut still receiving those annoying notifications.
Can anyone help?
-
@AlexanderK Do you have the setting "Zero padded ethernet addresses" checkbox checked? If not, check it and restart arpwatch.
-
@tinfoilmatt said in Arpwatch - sent wrong arp op 5:
@AlexanderK Do you have the setting "Zero padded ethernet addresses" checkbox checked? If not, check it and restart arpwatch.
It is already checked.
-
@AlexanderK Can you post a screenshot of your full arpwatch settings?
Looking at the arpwatch man page—and it's not clear that this
sent wrong arp op 5syslog message is a 'supressable' report, or even a report message at all. -
@tinfoilmatt said in Arpwatch - sent wrong arp op 5:
@AlexanderK Can you post a screenshot of your full arpwatch settings?
Looking at the arpwatch man page—and it's not clear that this
sent wrong arp op 5syslog message is a 'supressable' report, or even a report message at all.Yes here it is
🔒 Log in to view -
Arpwatch has no way to suppress protocol errors such as this. ANDwatch, a pending package to replace the Arpwatch package, allows suppression by way of pcap filtering.