Why does arpwatch report "new station" when an existing system adds or changes IP address?
Issue
- I'm running
arpwatch. When an existing system changes IP address, the messagenew stationis reported. This isn't a new station, because arpwatch has seen this MAC address before. - I've noticed that "new station" message is sent not only when a new ethernet address is detected, but also when a new IP is detected.
Environment
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- arpwatch
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.