Bug 1688031 - arpwatch reports "bad hardware format" for 802.1Q packets, filling the log file
Summary: arpwatch reports "bad hardware format" for 802.1Q packets, filling the log file
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: arpwatch
Version: 7.6
Hardware: x86_64
OS: Linux
unspecified
low
Target Milestone: rc
: ---
Assignee: Jan Synacek
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-03-12 23:55 UTC by kbell
Modified: 2019-03-13 08:04 UTC (History)
0 users

(edit)
Clone Of:
(edit)
Last Closed:


Attachments (Terms of Use)

Description kbell 2019-03-12 23:55:37 UTC
VLAN tagged packets (802.1Q) are reported as having "bad hardware format" by arpwatch-2.1a15-36.el7.x86_64 and thereby filling the syslog with these reports.

17:06:09.415338 xx:xx:xx:xx:xx:xx (oui Unknown) > yy:yy:yy:yy:yy:yy (oui Unknown), 802.3, length 39: LLC, dsap STP (0x42) Individual, ssap STP (0x42) Command, ctrl 0x03: STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8000.zz:zz:zz:zz:zz:zz.8214, length 43

This is not a new complaint, e.g., see:

https://bugzilla.redhat.com/show_bug.cgi?id=1297945

Steps to reproduce:

1. Install arpwatch
2. Run arpwatch
3. Watch these error messages fill the syslog


Note You need to log in before you can comment on or make changes to this bug.