Hei hei, I can confirm for arpwatch on Debian 9 (stretch).
There's a Windows 7 laptop on my network, which is frequently used in
other networks. After "returning home" it still has the old IP address
before getting a new one from my DHCP server. arpwatch reports this as
"new station", although the mac address is known. The database fills
up with such entries (mac addr last part replaced with xx):
root@falbala /var/lib/arpwatch # grep 00:23:14:xx:xx:xx arp.dat
00:23:14:xx:xx:xx 172.19.25.165 1459790929 eth0
00:23:14:xx:xx:xx 172.19.12.103 1499872037 eth0
00:23:14:xx:xx:xx 172.19.28.241 1515699236 eth0
00:23:14:xx:xx:xx 192.168.1.2 1499200486 eth0
00:23:14:xx:xx:xx 192.168.243.162 1516984428 furball eth0
00:23:14:xx:xx:xx 192.168.1.8 1496190353 eth0
00:23:14:xx:xx:xx 192.168.1.7 1497056388 eth0
00:23:14:xx:xx:xx 192.168.1.9 1501110083 eth0
00:23:14:xx:xx:xx 192.168.1.4 1516731353 eth0
00:23:14:xx:xx:xx 192.168.2.116 1516980534 eth0
00:23:14:xx:xx:xx 10.182.63.163 1471649481 furball eth0
00:23:14:xx:xx:xx 10.182.63.162 1489622622 furball eth0
00:23:14:xx:xx:xx 169.254.145.38 1516935943 eth0
This is what the man page says:
new station
The ethernet address has not been seen before.
In fact the ethernet address has seen before.
I could better ignore those messages if I could remember this one mac
address (see #527251) or maybe someone would like to fix this package?
O:-)
Greets
Alex
--
»With the first link, the chain is forged. The first speech censured,
the first thought forbidden, the first freedom denied, chains us all
irrevocably.« (Jean-Luc Picard, quoting Judge Aaron Satie)
*** GnuPG-FP: C28E E6B9 0263 95CF 8FAF 08FA 34AD CD00 7221 5CC6 ***
signature.asc
Description: PGP signature
