Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Suppress arpwatch flip flop emails for Bonjour Sleep Proxy

    Scheduled Pinned Locked Moved pfSense Packages
    24 Posts 4 Posters 4.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • chudakC
      chudak @dbwiddis
      last edited by

      @dbwiddis @dbwiddis

      Did you guys figure out the more perm solution?

      I see in file:

      #!/usr/bin/env php
      <?php
      
      require_once("notices.inc");
      
      $fd = fopen('php://stdin','r');
      $message = stream_get_contents($fd);
      fclose($fd);
      
      if (false !== $message) {
              $subject = array();
              preg_match('/^Subject: (.*)$/m', $message, $subject);
              $message = preg_replace('/^From: .*$/m', '', $message);
              $message = preg_replace('/^To: .*$/m', '', $message);
              $message = preg_replace('/^Subject: .*$/m', '', $message);
              $message = preg_replace("/^(\n){4}/", '', $message);
      
              send_smtp_message($message, "{$config['system']['hostname']}.{$config['system']['domain']} - Arpwatch Notificatio
      n : {$subject[1]}");
      }
      
      ?>
      
      1 Reply Last reply Reply Quote 0
      • D
        dbwiddis
        last edited by

        @chudak said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:

        Did you guys figure out the more perm solution?

        As I noted in my second post, the file is generated by code in /usr/local/pkg/arpwatch.inc. Editing that file seems to work! I'm receiving other mails but not the flip flop mails.

        chudakC 1 Reply Last reply Reply Quote 0
        • chudakC
          chudak @dbwiddis
          last edited by

          @dbwiddis

          Can you pls post the original and the change ?

          1 Reply Last reply Reply Quote 0
          • D
            dbwiddis
            last edited by dbwiddis

            EDIT: This has been fixed in release 0.2.0_2. Do not do the hacks below, just update your arpwatch package!

            It is posted in my original post. Look in /usr/local/pkg/arpwatch.inc for the line

            if (false !== $message) {
            

            And replace it with the below (substitute your own device MAC addresses):

            $flipflop='flip flop';
            $tv1='c8:69:cd:00:00:00';
            $tv2='e0:89:7e:00:00:00';
            $tv3='1c:1a:c0:00:00:00';
              
            if ((false !== $message) and (
              (false === strpos($message, $flipflop)) or
              ( (false === strpos($message, $tv1)) and
                (false === strpos($message, $tv2)) and
                (false === strpos($message, $tv3)) ))) {
            
            chudakC 1 Reply Last reply Reply Quote 0
            • chudakC
              chudak @dbwiddis
              last edited by

              @dbwiddis Thx !

              1 Reply Last reply Reply Quote 0
              • D
                dbwiddis
                last edited by

                Actually, I realized I had an error and reversed the order of the arguments in the strpos. I've corrected my posts. What I had suppressed all messages, oops :)

                chudakC 2 Replies Last reply Reply Quote 1
                • chudakC
                  chudak @dbwiddis
                  last edited by

                  @dbwiddis
                  I was about to say - it does not work :)

                  Thx for correction.
                  We will see now!

                  1 Reply Last reply Reply Quote 0
                  • chudakC
                    chudak @dbwiddis
                    last edited by

                    @dbwiddis said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:

                    Actually, I realized I had an error and reversed the order of the arguments in the strpos. I've corrected my posts. What I had suppressed all messages, oops :)

                    So far in last 3-4 hours it seem to be holding water :)
                    Did you tested if it will stay if arpwatch reinstalled it will stay in place or not ?

                    1 Reply Last reply Reply Quote 0
                    • D
                      dbwiddis
                      last edited by

                      @chudak said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:

                      Did you tested if it will stay if arpwatch reinstalled it will stay in place or not ?

                      I did just test and uninstall / reinstall arpwatch, and it wiped the script hack and the database. But it was easy to put back in.

                      1 Reply Last reply Reply Quote 0
                      • chudakC
                        chudak
                        last edited by

                        @dbwiddis

                        I installed arpwatch 0.2.0_1 and see 'sometimes' still flip flop emails.

                        Odd...
                        Do you see it after upgrade ?

                        D 1 Reply Last reply Reply Quote 0
                        • D
                          dbwiddis @chudak
                          last edited by

                          @chudak said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:

                          @dbwiddis

                          I installed arpwatch 0.2.0_1 and see 'sometimes' still flip flop emails.

                          Odd...
                          Do you see it after upgrade ?

                          Since uninstall/reinstall replaced my custom fixes it wouldn't surprise me if an upgrade overwrote any modifications you've made. Just go re-edit the /usr/local/pkg/arpwatch.inc file, and in the arpwatch config hit "save" to copy from there to /usr/local/arpwatch/sendmail_proxy.php. You can use the file viewer to confirm whether the modifications are there.

                          I have only seen one other "flip flop" email for a different device (my Orbi mesh router, that has a hidden mac/wifi address for its backhaul network).

                          chudakC 1 Reply Last reply Reply Quote 0
                          • chudakC
                            chudak @dbwiddis
                            last edited by

                            @dbwiddis said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:

                            /usr/local/arpwatch/sendmail_proxy.php

                            I did not did Save configuration step, hope it's good now.
                            Confirmed now the changes were saved to /usr/local/arpwatch/sendmail_proxy.php

                            Thx

                            1 Reply Last reply Reply Quote 1
                            • viktor_gV
                              viktor_g Netgate
                              last edited by

                              Please see https://redmine.pfsense.org/issues/10474

                              Sergei_ShablovskyS 1 Reply Last reply Reply Quote 2
                              • D
                                dbwiddis
                                last edited by

                                @viktor_g Fantastic! I had thought about doing something like that but had no clue where to start.

                                1 Reply Last reply Reply Quote 0
                                • D
                                  dbwiddis
                                  last edited by dbwiddis

                                  So now that @viktor_g showed us the right way to make a permanent fix, I've implemented that change as well as my own tweak to it, and another request to not wipe the database on uninstall/upgrade. I love this community. :)

                                  Image 4-18-20 at 11.09 AM.jpeg

                                  chudakC 2 Replies Last reply Reply Quote 1
                                  • chudakC
                                    chudak @dbwiddis
                                    last edited by

                                    @dbwiddis very cool !

                                    What's ETA for this to be merged ?

                                    D 1 Reply Last reply Reply Quote 0
                                    • D
                                      dbwiddis @chudak
                                      last edited by

                                      @chudak said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:

                                      What's ETA for this to be merged ?

                                      Dunno, @viktor_g made a pull request that someone has to review, and I made a pull request to his branch that he has to review (and testing indicates might be broken...) and then even when they are all accepted they need to release 0.2.0_2.

                                      So.... don't hold your breath, but if you're comfortable hacking a bit, you can get a jump on the official release :)

                                      D 1 Reply Last reply Reply Quote 0
                                      • D
                                        dbwiddis @dbwiddis
                                        last edited by dbwiddis

                                        @dbwiddis said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:

                                        ... and I made a pull request to his branch that he has to review (and testing indicates might be broken...)

                                        Finally figured out my error.... 0 can be either false or true depending on which logical operator you use.

                                        1 Reply Last reply Reply Quote 0
                                        • chudakC
                                          chudak @dbwiddis
                                          last edited by

                                          @dbwiddis @viktor_g

                                          PR was merged and I installed update, hope it will be great !

                                          D 1 Reply Last reply Reply Quote 1
                                          • D
                                            dbwiddis @chudak
                                            last edited by

                                            @chudak said in Suppress arpwatch flip flop emails for Bonjour Sleep Proxy:

                                            @dbwiddis @viktor_g

                                            PR was merged and I installed update, hope it will be great !

                                            Updated as well, looks good!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.