Forums

Resolved
0 votes
Hello,

I am using ClearOs Community 7.5
Ever since I have added a guest network to my access point, I have the following message over flooding my /var/log/messages:
Mar  2 09:39:04 mail arpwatch: c4:12:f5:a8:1f:e1 sent bad hardware format 0x5

On the access point I have tagged traffic from the guest SSID with vlanid 5 , on clearos I have a VLAN 5 configured as a hot lan.
Other than the messages this setup does work without any problems
Saturday, March 02 2019, 09:07 AM
Share this post:
Responses (4)
  • Accepted Answer

    Wednesday, May 01 2019, 03:34 PM - #Permalink
    Resolved
    0 votes
    Have a look at your yum.log for the period and see if there were any updates. It is possible that we patched arpwatch a while ago then an update reverted it to upstream which was not patched.
    The reply is currently minimized Show
  • Accepted Answer

    Wednesday, May 01 2019, 03:15 PM - #Permalink
    Resolved
    0 votes
    This is, in fact, an old centos/redhat bug... *BUT* it didn't start appearing on our system here until March 4, 2019 at 12:36am.

    I was not making configuration changes at 12:36am, and we've been using lots of VLANs since 2017.

    Currently I can confirm that the "hardware format" ids it's listing are the vlan numbers.

    Is it possible that the bug /was/ addressed in some way, and an update (either yours or RH's) brought it back?
    The reply is currently minimized Show
  • Accepted Answer

    Saturday, March 02 2019, 09:32 AM - #Permalink
    Resolved
    0 votes
    Looks like an old bug never patched by RedHat. It may be best to junk the messages in rsyslog.
    The reply is currently minimized Show
  • Accepted Answer

    Saturday, March 02 2019, 09:16 AM - #Permalink
    Resolved
    0 votes
    Hmm. When I've seen these before I've been told they are because of mis-configured switches. I've no idea what the particular misconfiguration is. Is c4:12:f5:a8:1f:e1 the AP? It is possible to dump the messages by setting up a filter in rsyslog.
    The reply is currently minimized Show
Your Reply