Suppress arpwatch flip flop emails for Bonjour Sleep Proxy
-
EDIT: This has been fixed in release 0.2.0_2. Do not do the hacks below, just update your arpwatch package!
Well, I've managed a temporary hack to stop the messages! I say "temporary" because any change to the arpwatch settings (basically pressing the "save button") undoes them.
There is a file /usr/local/arpwatch/sendmail_proxy.php which does the final step of actually sending the mail, after a little parsing. In that file, I've replaced the line that currently says:
if (false !== $message) {with a more expanded conditional check which will only send the message if it is not a flip flop email, or does not contain the mac addresses (obfuscated below) of my problematic devices:
$flipflop='flip flop'; $tv1='c8:69:cd:00:00:00'; $tv2='e0:89:7e:00:00:00'; $tv3='1c:1a:c0:00:00:00'; if ((false !== $message) and ( (false === strpos($message, $flipflop)) or ( (false === strpos($message, $tv1)) and (false === strpos($message, $tv2)) and (false === strpos($message, $tv3)) ))) {Now if I can figure out where this code gets overwritten on the "save" I can try to make it more permanent.
-
Aha! That code is written from inside /usr/local/pkg/arpwatch.inc. So if I edit that file it'll not get overwritten unless I remove and re-add the package.
-
Did you guys figure out the more perm solution?
I see in file:
#!/usr/bin/env php <?php require_once("notices.inc"); $fd = fopen('php://stdin','r'); $message = stream_get_contents($fd); fclose($fd); if (false !== $message) { $subject = array(); preg_match('/^Subject: (.*)$/m', $message, $subject); $message = preg_replace('/^From: .*$/m', '', $message); $message = preg_replace('/^To: .*$/m', '', $message); $message = preg_replace('/^Subject: .*$/m', '', $message); $message = preg_replace("/^(\n){4}/", '', $message); send_smtp_message($message, "{$config['system']['hostname']}.{$config['system']['domain']} - Arpwatch Notificatio n : {$subject[1]}"); } ?> -
@chudak said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:
Did you guys figure out the more perm solution?
As I noted in my second post, the file is generated by code in /usr/local/pkg/arpwatch.inc. Editing that file seems to work! I'm receiving other mails but not the flip flop mails.
-
Can you pls post the original and the change ?
-
EDIT: This has been fixed in release 0.2.0_2. Do not do the hacks below, just update your arpwatch package!
It is posted in my original post. Look in /usr/local/pkg/arpwatch.inc for the line
if (false !== $message) {And replace it with the below (substitute your own device MAC addresses):
$flipflop='flip flop'; $tv1='c8:69:cd:00:00:00'; $tv2='e0:89:7e:00:00:00'; $tv3='1c:1a:c0:00:00:00'; if ((false !== $message) and ( (false === strpos($message, $flipflop)) or ( (false === strpos($message, $tv1)) and (false === strpos($message, $tv2)) and (false === strpos($message, $tv3)) ))) { -
@dbwiddis Thx !
-
Actually, I realized I had an error and reversed the order of the arguments in the strpos. I've corrected my posts. What I had suppressed all messages, oops :)
-
@dbwiddis
I was about to say - it does not work :)Thx for correction.
We will see now! -
@dbwiddis said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:
Actually, I realized I had an error and reversed the order of the arguments in the strpos. I've corrected my posts. What I had suppressed all messages, oops :)
So far in last 3-4 hours it seem to be holding water :)
Did you tested if it will stay if arpwatch reinstalled it will stay in place or not ? -
@chudak said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:
Did you tested if it will stay if arpwatch reinstalled it will stay in place or not ?
I did just test and uninstall / reinstall arpwatch, and it wiped the script hack and the database. But it was easy to put back in.
-
I installed arpwatch 0.2.0_1 and see 'sometimes' still flip flop emails.
Odd...
Do you see it after upgrade ? -
@chudak said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:
I installed arpwatch 0.2.0_1 and see 'sometimes' still flip flop emails.
Odd...
Do you see it after upgrade ?Since uninstall/reinstall replaced my custom fixes it wouldn't surprise me if an upgrade overwrote any modifications you've made. Just go re-edit the /usr/local/pkg/arpwatch.inc file, and in the arpwatch config hit "save" to copy from there to /usr/local/arpwatch/sendmail_proxy.php. You can use the file viewer to confirm whether the modifications are there.
I have only seen one other "flip flop" email for a different device (my Orbi mesh router, that has a hidden mac/wifi address for its backhaul network).
-
@dbwiddis said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:
/usr/local/arpwatch/sendmail_proxy.php
I did not did Save configuration step, hope it's good now.
Confirmed now the changes were saved to /usr/local/arpwatch/sendmail_proxy.phpThx
-
Please see https://redmine.pfsense.org/issues/10474
-
@viktor_g Fantastic! I had thought about doing something like that but had no clue where to start.
-
So now that @viktor_g showed us the right way to make a permanent fix, I've implemented that change as well as my own tweak to it, and another request to not wipe the database on uninstall/upgrade. I love this community. :)
-
@dbwiddis very cool !
What's ETA for this to be merged ?
-
@chudak said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:
What's ETA for this to be merged ?
Dunno, @viktor_g made a pull request that someone has to review, and I made a pull request to his branch that he has to review (and testing indicates might be broken...) and then even when they are all accepted they need to release 0.2.0_2.
So.... don't hold your breath, but if you're comfortable hacking a bit, you can get a jump on the official release :)
-
@dbwiddis said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:
... and I made a pull request to his branch that he has to review (and testing indicates might be broken...)
Finally figured out my error.... 0 can be either false or true depending on which logical operator you use.
