Arpwatch sending notifications for unselected interfaces

mrnb

pfSense 26.03.1
arpwatch 0.2.5

Since I upgraded to 26.04.1, the arpwatch package sends me notifications for ALL Interfaces, not just the ones I selected.

Not sure what diagnostics I can upload.

Things I've tried:

Re-install the package (I kept the configuration)
De-select, save and re-select the chosen interfaces

dennypage

@mrnb I recommend replacing Arpwatch with ANDwatch.

mrnb

@dennypage said in Arpwatch sending notifications for unselected interfaces:

@mrnb I recommend replacing Arpwatch with ANDwatch.

Well I haven't noticed this package before!

Thank you I will switch over and see how it goes.

Gertjan

@mrnb said in Arpwatch sending notifications for unselected interfaces:

Since I upgraded to 26.04.1

Typo ?

mrnb

@Gertjan said in Arpwatch sending notifications for unselected interfaces:

@mrnb said in Arpwatch sending notifications for unselected interfaces:

Since I upgraded to 26.04.1

Typo ?

Yep I meant 26.03.1.

Cannot fix the typo, not allowed anymore hah.

mrnb

Now that I switched to ANDwatch the problem appears more obviously.

I am still having incorrect notifications:

Here's a sample of the notifications:

07:01:33 ANDwatch notificaton

             timestamp: 2026-06-05 07:01:32
             interface: 10NETWORKDEVICES
              hostname: (unknown)
            ip address: 10.2.0.82
  new ethernet address: 96:10:73:ba:7a:eb
      new ethernet org: (private)

06:14:49 ANDwatch notificaton

             timestamp: 2026-06-05 06:14:48
             interface: 10NETWORKDEVICES
              hostname: (unknown)
            ip address: 10.12.0.240
  new ethernet address: 00:92:35:ac:44:64
      new ethernet org: Apple, Inc.

06:09:54 ANDwatch notificaton

             timestamp: 2026-06-05 06:09:52
             interface: 10NETWORKDEVICES
              hostname: (unknown)
            ip address: 10.2.0.119
  new ethernet address: 5e:10:cf:80:81:6a
      new ethernet org: (private)

It goes on and on and on.

The thing is, 10.2.0.0/42 is NOT in the 10NETWORKDEVICES VLAN. That's the 20GUEST VLAN.

I do not want to arpwatch on the Guest VLAN.

The thing is, 10.12.0.0/42 is NOT in the 10NETWORKDEVICES VLAN either:

Why does it keep mis-appropriating these IPs to the wrong interface?

Here's a CORRECT notification:

01:04:57 ANDwatch notificaton

             timestamp: 2026-06-05 01:04:56
             interface: 30VOIP
              hostname: lbby-mentrf-phone-1.hostname.com
            ip address: 10.3.0.25
  new ethernet address: 00:20:f7:04:ac:cd
      new ethernet org: CYBERDATA CORPORATION

EDIT: the 10NETWORKDEVICES VLAN and interface contains the management interface for all of the unifi switches/aps and nothing else.

dennypage

@mrnb it seems that you have packets bleeding between vlans on the physical interfaces. You can confirm with tcpdump.

If I had to guess, I would think it’s an interaction between the lagg and vlan configuration.

mrnb

@dennypage

Ohh odd, I'm not very good at troubleshooting this kind of thing. I reached out to TAC Professional support and maybe they can help out.

Thanks.