arpwatch broken

  • Hey guys,
    I just installed the arpwatch package on my SG-4860 running up to date 2.4.3.
    Sadly it seems like the package is currently broken even though it has been updated on github february 2018.
    The package hung up twice now after running for some time, once it took down the whole pfsense box (reboot fixed it). Usually it starts with being unable to open Service -> Arpwatch -> Database
    When the package hangs, I can't restart the service or deinstall the package, only a reboot helps.
    Also every notification gets send out twice and notifications wont send if notifications for pfsense are disabled (which should not matter for the package IMHO) I have them disabled because I get a notification for every dyndns IP change, so every day.
    Anyone else having similiar problems?

  • LAYER 8 Global Moderator

    I did not pin it down to arpwatch... But I was having some issues of late of pfsense hanging up.. Would loose ssh access, console access even, web.. It would still be routing and clients working, it would answer ping.. But could not get to anything on pfsense. Would have to reboot to regain access.

    Since it was the last package I had installed since the problem showed up.. It happened once on its own, and then hung on me in the middle of package update for a different package twice, etc.

    Figured I would uninstall and see if happens again. Since my sg4860 running 2.4.3p1 has really been rock solid since I had gotten it. Problem was after it would lock up could find nothing in the logs other than me rebooting it, etc.

    Also arpwatch wasn't really working as it should - on a reboot it I would get emails on every mac, which it shouldn't of been doing.

    So I can not confirm arpwatch had anything to do with my problems, I can not rule it out either. And you posting that you had a lockup/hang gets me thinking that it could be the problem. Will see if anyone else chimes in with any sim horror stories and arpwatch.

    Will let you know if my problem seems to have cleared up. I have had 3 lock ups in the last week.. So if nothing going forward in say the next week, I will add some other packages, etc. trying to repeat 2 of the lock ups have seen. Then yeah points to arpwatch.

  • @johnpoz I had the excact same lockout "experience". I'm 99% sure this is related to arpwatch.

    "on a reboot it I would get emails on every mac, which it shouldn’t of been doing."
    Ok this makes it completly useless. I uninstalled the package now.
    Sad :(

  • Galactic Empire

    Can you please open a redmine ticket and provide logs if possible? Thanks!

  • I believe the issue is with the arpwatch binaries. After a couple of days, I'm unable to stop arpwatch which I have running on 3 interfaces (em2, em0.5, em0.10). killall doesn't work and when I reboot, it hangs until I manually shut off the router. I'm still testing this, but I left the package install, but I removed binaries and re-installed them from Both repositories have the same arpwatch version but the file size of the package was different by 1 or 2 KBs

  • Kinda scary that the package is still in the official repository.. If you cant fix it / dont want to fix it atleast delete it from available packages!

  • LAYER 8 Global Moderator

    I would like to find the time to troubleshoot this and prove its arpwatch... But its difficult to install and then leave running when your pfsense could hang up at any time after working fine for time. Might be away when it goes down, and then blocked from getting into my network.

  • Galactic Empire

    We have opened a bug report here

    Any input from arpwatch users is welcome. Thanks!

  • i'll add my findings to the bug report

  • I have the same problems as everyone else. Pfsense hangs and the only way to get it back is a hard reset. i noticed that any client that has a static IP set drops and loose connection when the lease is up for renew.
    Don't see anything in the logs related to arpwatch.

  • @dayve please post it in the bug report as well

  • Same problem here with arpwatch. The database hung up, Pfsense web interface and ssh hung up too, but routing is still working. I cannot even uninstall it using the GUI. How to uninstall it?

  • @dpa please post it on redmine so the devs can see it

  • @ivor said in arpwatch broken:

    We have opened a bug report here

    Any input from arpwatch users is welcome. Thanks!

    Hey ivor,
    are there any updates to this?

Log in to reply