arpscan seeing incorect mac address

[jonwaland]

Hi @jokob-sk - can you take a look at royhills/arp-scan#199

And suggest which settings I need to change to increase the log info to see what ARPSCAN is doing?

thanks

[jokob-sk]

Hi @jonwaland ,

I'd switch LOG_LEVEL to verbose and increase the log length in MAINT_LOG_LENGTH. This should log the arpscan output and keep it in the log long enough to debug. The log can be found under /app/log (you could periodically back it up so as to not to lose any logs) or under Maintenance -> Logs.

Please check the log if it provides sufficient information to debug the issue as I can add more logging.

[jonwaland]

LOG_LEVEL already set to verbose and MAINT_LOG_LENGTH increased from 250000 to 1000000 - however I suspect the ARP_SCAN shell script wrapper hides a lot of the output?

Searching app.log for ARP only gets:

09:45:22 [ARP Scan] In script 
09:45:22 [ARPSCAN] userSubnetsParam: 192.168.1.1-192.168.1.254 --interface=eno1

[jokob-sk]

Hi @jonwaland ,

I set my log level to debug and this is the log entry

https://i.imgur.com/phcO4lB.png

Don't filter your results if yo use the UI

[jonwaland]

So I did that - but didn't bother to check if it changed anything. It doesn't appear to have -this is the last 30 minutes with log_level set to debug:

11:30:47 [ARP Scan] In script 
11:30:47 [ARPSCAN] userSubnetsParam: 192.168.1.1-192.168.1.254 --interface=eno1
11:30:47 [Database] Opening DB
11:31:00 [DBCLNP] In script
11:31:00 [DBCLNP] Upkeep Database:
11:31:00 [DBCLNP] Online_History: Delete all but keep latest 150 entries
11:31:00 [DBCLNP] Events: Delete all older than 90 days (DAYS_TO_KEEP_EVENTS setting)
11:31:00 [DBCLNP] Plugins_History: Trim Plugins_History entries to less than 250 per Plugin (PLUGINS_KEEP_HIST setting)
11:31:00 [DBCLNP] Plugins_History: Trim Notifications entries to less than 100
11:31:00 [DBCLNP] Trim AppEvents to less than 5000
11:31:00 [DBCLNP] Plugins_Objects: Delete all duplicates
11:31:00 [DBCLNP] WAL checkpoint executed to truncate file.
11:31:00 [DBCLNP] Shrink Database
11:36:03 [ARP Scan] In script 
11:36:03 [ARPSCAN] userSubnetsParam: 192.168.1.1-192.168.1.254 --interface=eno1
11:36:03 [Database] Opening DB
11:40:15 [ARP Scan] In script 
11:40:15 [ARPSCAN] userSubnetsParam: 192.168.1.1-192.168.1.254 --interface=eno1
11:40:15 [Database] Opening DB
Starting new HTTPS connection (1): api.github.com:443
https://api.github.com:443 "GET /repos/jokob-sk/NetAlertX/releases HTTP/1.1" 200 None
127.0.0.1 - - [11/Apr/2025 11:44:16] "POST /graphql HTTP/1.1" 200 -
127.0.0.1 - - [11/Apr/2025 11:44:19] "POST /graphql HTTP/1.1" 200 -
11:45:32 [ARP Scan] In script 
11:45:32 [ARPSCAN] userSubnetsParam: 192.168.1.1-192.168.1.254 --interface=eno1
11:45:32 [Database] Opening DB
127.0.0.1 - - [11/Apr/2025 11:48:43] "POST /graphql HTTP/1.1" 200 -

App updates  You are up-to-date. Check out what [I am working on](https://github.com/jokob-sk/NetAlertX/issues/138).
Built on	2025-04-01
Installed version	v25.4.1
Database-Path	/app/db/app.db
Database-Size	13,01 MB (wal: 12,71 MB)
Table (Rows)	sqlite_stat1 (0), Events (40993), Sessions (12090), Online_History (154), sqlite_sequence (7), Plugins_Objects (245), Plugins_Events (0), Plugins_History (1316), Notifications (100), Devices (80), Settings (286), Parameters (0), Plugins_Language_Strings (639), CurrentScan (0), AppEvents (5320),
Last Modification	April 11 2025 11:45:45

On the off chance I have to restart the container, I have just done so...

And debug logging now running:

11:55:42 [Plugin utils] Pre-Resolved CMD: python3/app/front/plugins/arp_scan/script.pyuserSubnets={subnets}
11:55:42 [Plugins] Executing: python3 /app/front/plugins/arp_scan/script.py userSubnets={subnets}
11:55:42 [Plugins] Resolved : ['python3', '/app/front/plugins/arp_scan/script.py', "userSubnets=b'MTkyLjE2OC4xLjEtMTkyLjE2OC4xLjI1NCAtLWludGVyZmFjZT1lbm8x'"]
11:55:42 [ARP Scan] In script 
11:55:42 [ARPSCAN] userSubnetsParam: 192.168.1.1-192.168.1.254 --interface=eno1
11:55:42 [Database] Opening DB
11:55:53 [Plugins] Output: [plugin_helper] reading config file
11:55:42 [ARP Scan] In script 
11:55:42 [ARPSCAN] userSubnetsParam: 192.168.1.1-192.168.1.254 --interface=eno1
11:55:42 [Database] Opening DB
11:55:53 [ARPSCAN] arpscan_output: Interface: eno1, type: EN10MB, MAC: 54:b2:03:19:8e:a5, IPv4: 192.168.1.128
Starting arp-scan 1.10.0 with 254 hosts (https://github.com/royhills/arp-scan)
192.168.1.131	00:24:1d:27:1c:32	GIGA-BYTE TECHNOLOGY CO.,LTD.
192.168.1.39	60:01:94:66:ad:d1	Espressif Inc.
192.168.1.78	80:7d:3a:4f:48:53	Espressif Inc.
192.168.1.68	f0:b4:29:bd:ea:47	Xiaomi Communications Co Ltd
192.168.1.72	78:11:dc:e1:f8:cd	XIAOMI Electronics,CO.,LTD

etc

[jokob-sk]

Hi @jonwaland,

I'm travelling the next 3 weeks so can't help out. You can raise a PR with additional logging or just modify the file in y your system by mounting it in your docker compose file.

Thanks for understanding,
J

[jonwaland]

no action required - I was flagging that I needed to restart the docker container to change the log level - this wasn't clear originally.

[jokob-sk]

Hi @jonwaland - I'm following along the discussion on the arp-scan repo.

(adding -v -v -v to the call in netalertx will likely cause issues)

You could modify the front/plugins/arp_scan/script.py on your server, mount your version and include an additional call with these parameters just for logging purposes. E.g. (didn't test)

def execute_arpscan_on_interface(interface):
    # Prepare command arguments
    arpscan_args = get_setting_value('ARPSCAN_ARGS').split() + interface.split()

    # Execute command
    try:
        # try running a subprocess safely
        result = subprocess.check_output(arpscan_args, universal_newlines=True)
    except subprocess.CalledProcessError as e:
        # An error occurred, handle it
        error_type = type(e).__name__  # Capture the error type
        result = ""

    # Execute command JUST FOR DEBUGGING
    try:
        # try running a subprocess safely
        arpscan_args = (get_setting_value('ARPSCAN_ARGS') + ' -v -v -v ').split() + interface.split()
        result_debug = subprocess.check_output(arpscan_args, universal_newlines=True)
    except subprocess.CalledProcessError as e:
        # An error occurred, handle it
        error_type = type(e).__name__  # Capture the error type
        result_debug = ""

    mylog('verbose', [f'[{pluginName}] arpscan_output result_debug: ', result_debug]) 

    return result