ArpWatch supression not working for "flip-flop"

sgnoc

I have installed the ArpWatch package on my XG-7100. It seems to be working how I would like to use it with one exception. I have a UAP-XG access point that gets reported regularly for flip-flops between two mac addresses. Sometimes I end up getting a dozen notices in a short amount of time.

I placed both mac address that are being reported as flip-flop from the AP, saved and also tried restarting the service, but I still get the notifications for the mac addresses. I set them to only suppress flip-flop instead of all.

I've read that changing to "all" might fix the glitch, but I'm trying to find out where to report this issue to try and have it fixed in a future update. I'd rather just suppress the flip flop messages for these 2 mac addresses instead of all notifications for them.

Thanks

KOM

@sgnoc said in ArpWatch supression not working for "flip-flop":

but I'm trying to find out where to report this issue to try and have it fixed in a future update

redmine.pfsense.org

sgnoc

@kom Thanks!

viktor_g

Please check with the latest ArpWatch package version

sgnoc

@viktor_g I updated to the most recent arpwatch last night, 0.2.0_5. I then changed the settings back to suppress just the flip-flop for the two MAC addresses that I keep getting notices. By this morning I had another dozen or more notices from those 2 MAC addresses for flip-flop notifications.

I'm going to try and restart the service and see if maybe that will get it to reset.

viktor_g

@sgnoc said in ArpWatch supression not working for "flip-flop":

@viktor_g I updated to the most recent arpwatch last night, 0.2.0_5. I then changed the settings back to suppress just the flip-flop for the two MAC addresses that I keep getting notices. By this morning I had another dozen or more notices from those 2 MAC addresses for flip-flop notifications.

I'm going to try and restart the service and see if maybe that will get it to reset.

Unable to reproduce your issue -
I can successfully suppress flip-flop messages on 21.05 with ArpWatch 0.2.0_5

Could you show a screenshot and/or config of ArpWatch?

I think it could be related to MAC address case (aa:bb:cc vs AA:BB:CC)

sgnoc

@viktor_g said in ArpWatch supression not working for "flip-flop":

Unable to reproduce your issue -
I can successfully suppress flip-flop messages on 21.05 with ArpWatch 0.2.0_5

Could you show a screenshot and/or config of ArpWatch?

I think it could be related to MAC address case (aa:bb:cc vs AA:BB:CC)

I'm running 21.05 and ArpWatch 0.2.0_5. I've restarted the service as well as the XG-7100 with no changes. Here is the config and the email notice that I get:

The Ubiquiti AP uses two different mac addresses on the same IP frequently, so I get numerous email notifications a day. I made sure to keep lowercase mac addresses on everything to keep them the same. Are you using only upper case? That is the only thing I have not tried.

*** Edit *** I also just updated to 21.05.1 and still have the same behavior.

riggi

same problem here with flip flop notifications for a server that uses a bridge on its interface.

MAC are all lower case here, as reported in the notification.

package version 0.2.1