Arpwatch messages

[paleogryph]

I setup arpwatch on RH8 like this in the arpwatch file in /etc/init.d:

daemon arpwatch -n xx.xx.xx.xx -u pcap -e me@address.com

It seems to work but I am seeing this in /var/log/messages:

arpwatch: 0:c0:2:a6:60:78 sent packet not ETHERNET_IP (0x863)
arpwatch: 0:c0:2:a6:60:78 sent bad hardware format 0x3001

Anybody know what these mean? I'm assuming here that its talking about the nic, but why?

thanks



>Think for yourself<
...or someone else will do it for you.

 

[miblo]

Is the MAC address in your example from the machine running arpwatch, or is arpwatch seeing it on the network?

If it's on the network, it could be some device sending proprietary non-ip traffic which arpwatch is misinterpreting.

~Mike