Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1688031 - arpwatch reports "bad hardware format" for 802.1Q packets, filling the log file
Summary: arpwatch reports "bad hardware format" for 802.1Q packets, filling the log file
Keywords:
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: arpwatch
Version: 7.6
Hardware: x86_64
OS: Linux
unspecified
low
Target Milestone: rc
: ---
Assignee: Jan Synacek
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-03-12 23:55 UTC by kbell
Modified: 2019-03-13 08:04 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:


Attachments (Terms of Use)

Description kbell 2019-03-12 23:55:37 UTC
VLAN tagged packets (802.1Q) are reported as having "bad hardware format" by arpwatch-2.1a15-36.el7.x86_64 and thereby filling the syslog with these reports.

17:06:09.415338 xx:xx:xx:xx:xx:xx (oui Unknown) > yy:yy:yy:yy:yy:yy (oui Unknown), 802.3, length 39: LLC, dsap STP (0x42) Individual, ssap STP (0x42) Command, ctrl 0x03: STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8000.zz:zz:zz:zz:zz:zz.8214, length 43

This is not a new complaint, e.g., see:

https://bugzilla.redhat.com/show_bug.cgi?id=1297945

Steps to reproduce:

1. Install arpwatch
2. Run arpwatch
3. Watch these error messages fill the syslog


Note You need to log in before you can comment on or make changes to this bug.