getting different/wrong MAC address now and then

[jonwaland]

(as you know) I'm using ARPSCAN as part of NetAlertX, and I have now had two occurrences of a partial MAC duplicate.

device mac address is 9c:5a:81:ba:6a:46. But ARPSCAN has also reported it as 9c:5a:91:ba:6a:46 which isn't rec recognized as a valid MAC vendor id

correct:

incorrect:

Unfortunately I wasn't quick enough to see if there was any logging provided. Is this something known about?

[royhills]

The latest IEEE Mac/vendor mapping file from GitHub shows that the vendor name lookup gives the same results. So we can eliminate out of date mapping files and the hash table lookup process.

localhost:~/arp-scan# ls -l ieee-oui.txt 
-rw-r--r--    1 root     root       1649021 Feb 23 10:59 ieee-oui.txt
localhost:~/arp-scan# grep -i 9c5a81 ieee-oui.txt 
9C5A81  Xiaomi Communications Co Ltd
localhost:~/arp-scan# grep -i 9c5a91 ieee-oui.txt 
localhost:~/arp-scan# 

[royhills]

This is an unusual finding that I’ve not observed before, and there has not been any issues logged for it. So thank you for reporting it.

What’s really strange is that it’s the OUI that’s changing, which no network stack should do.

There are two bits that differ between 81 and 91, so it’s not a single bit change:

91 dec = 01011011 binary
81 dec = 01010001 binary 

I’ll give this some thought and will comment later.

[royhills]

You could try running arp-scan directly against the IP of the device in question. Arp-scan allows you to specify the same address multiple times (although this usage is uncommon), for example to run against 10.128.0.1 ten times with 5000ms between requests you could do this (using bash shell):

$ arp-scan $(eval echo {1..10} | sed "s/[[:digit:]]*/10.128.0.1/g") -i 5000
Interface: ens4, type: EN10MB, MAC: 42:01:0a:80:00:04, IPv4: 10.128.0.4
Starting arp-scan 1.10.1-git with 10 hosts (https://github.com/royhills/arp-scan)
10.128.0.1      42:01:0a:80:00:01       (Unknown: locally administered)
10.128.0.1      42:01:0a:80:00:01       (Unknown: locally administered)
10.128.0.1      42:01:0a:80:00:01       (Unknown: locally administered)
10.128.0.1      42:01:0a:80:00:01       (Unknown: locally administered)
10.128.0.1      42:01:0a:80:00:01       (Unknown: locally administered)
10.128.0.1      42:01:0a:80:00:01       (Unknown: locally administered)
10.128.0.1      42:01:0a:80:00:01       (Unknown: locally administered)
10.128.0.1      42:01:0a:80:00:01       (Unknown: locally administered)

9 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.1-git: 10 hosts scanned in 45.337 seconds (0.22 hosts/sec). 8 responded

Note that only 8 out of the 10 requests results in a response. I’m not sure why this is but I don’t think it affects the result.

This would remove netalertx from the equation and also provide more flexibility for debugging.

[jonwaland]

hmm..

sudo arp-scan $(eval echo {1..100} | sed "s/[[:digit:]]*/192.168.1.177/g") -i 5000
Interface: eno1, type: EN10MB, MAC: 54:b2:03:19:8e:a5, IPv4: 192.168.1.128
Starting arp-scan 1.10.1-git with 100 hosts (https://github.com/royhills/arp-scan)
192.168.1.177   9c:5a:81:ba:6a:46       Xiaomi Communications Co Ltd
[snip]
192.168.1.177   9c:5a:81:ba:6a:46       Xiaomi Communications Co Ltd

473 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.1-git: 100 hosts scanned in 480.285 seconds (0.21 hosts/sec). 64 responded

I've enabled email notifications on new devices in NetAlertX, so I'll wait and see if I can get an other occurrence.

[jonwaland]

annoyingly, been sick so I missed this one:

[jonwaland]

Another:

Again, the third part.

Not enough log info to see what happened. I'll ping the netalertx developer

[jonwaland]

netalertx/NetAlertX#1038

[jonwaland]

got one - a4:f1:f8:9d:20:70 - should be a4:f1:e8:9d:20:70 - the ipad again.

03:10:51 [Plugins] Check if any plugins need to be executed on run type: schedule
03:10:51 [Scheduler] run for ARPSCAN: YES
03:10:51 [Plugin utils] ---------------------------------------------
03:10:51 [Plugin utils] display_name: Arp-Scan (Network scan)
03:10:51 [Plugins] CMD: python3 /app/front/plugins/arp_scan/script.py userSubnets={subnets}
03:10:51 [Plugins] Resolving param: {'name': 'subnets', 'type': 'setting', 'value': 'SCAN_SUBNETS', 'base64': True}
03:10:51 [Plugins] setTyp: {"dataType": "array","elements": [{"elementType": "input","elementOptions": [{"placeholder": "192.168.1.0/24 --interface=eth1"},{"suffix": "_in"},{"cssClasses": "col-sm-10"},{"prefillValue": "null"}],"transformers": []},{"elementType": "button","elementOptions": [{"sourceSuffixes": ["_in"]},{"separator": ""},{"cssClasses": "col-xs-12"},{"onClick": "addList(this, false)"},{"getStringKey": "Gen_Add"}],"transformers": []},{"elementType": "select","elementHasInputValue": 1,"elementOptions": [{"multiple": "true"},{"readonly": "true"},{"editable": "true"}],"transformers": []},{"elementType": "button","elementOptions": [{"sourceSuffixes": []},{"separator": ""},{"cssClasses": "col-xs-6"},{"onClick": "removeAllOptions(this)"},{"getStringKey": "Gen_Remove_All"}],"transformers": []},{"elementType": "button","elementOptions": [{"sourceSuffixes": []},{"separator": ""},{"cssClasses": "col-xs-6"},{"onClick": "removeFromList(this)"},{"getStringKey": "Gen_Remove_Last"}],"transformers": []}]}
03:10:51 [Plugins] setTypJSN: {'dataType': 'array', 'elements': [{'elementType': 'input', 'elementOptions': [{'placeholder': '192.168.1.0/24 --interface=eth1'}, {'suffix': '_in'}, {'cssClasses': 'col-sm-10'}, {'prefillValue': 'null'}], 'transformers': []}, {'elementType': 'button', 'elementOptions': [{'sourceSuffixes': ['_in']}, {'separator': ''}, {'cssClasses': 'col-xs-12'}, {'onClick': 'addList(this, false)'}, {'getStringKey': 'Gen_Add'}], 'transformers': []}, {'elementType': 'select', 'elementHasInputValue': 1, 'elementOptions': [{'multiple': 'true'}, {'readonly': 'true'}, {'editable': 'true'}], 'transformers': []}, {'elementType': 'button', 'elementOptions': [{'sourceSuffixes': []}, {'separator': ''}, {'cssClasses': 'col-xs-6'}, {'onClick': 'removeAllOptions(this)'}, {'getStringKey': 'Gen_Remove_All'}], 'transformers': []}, {'elementType': 'button', 'elementOptions': [{'sourceSuffixes': []}, {'separator': ''}, {'cssClasses': 'col-xs-6'}, {'onClick': 'removeFromList(this)'}, {'getStringKey': 'Gen_Remove_Last'}], 'transformers': []}]}
03:10:51 [Plugins] dType: array
03:10:51 [Plugin utils] Flattening the below array
03:10:51 ['192.168.1.1-192.168.1.254 --interface=eno1']
03:10:51 [Plugin utils] isinstance(arr, list) : False | isinstance(arr, str) : True
03:10:51 [Plugins] Resolved value: 192.168.1.1-192.168.1.254 --interface=eno1
03:10:51 [Plugins] Convert to Base64: True
03:10:51 [Plugins] base64 value: b'MTkyLjE2OC4xLjEtMTkyLjE2OC4xLjI1NCAtLWludGVyZmFjZT1lbm8x'
03:10:51 [Plugins] Timeout: 300
03:10:51 [Plugin utils] Pre-Resolved CMD: python3/app/front/plugins/arp_scan/script.pyuserSubnets={subnets}
03:10:51 [Plugins] Executing: python3 /app/front/plugins/arp_scan/script.py userSubnets={subnets}
03:10:51 [Plugins] Resolved : ['python3', '/app/front/plugins/arp_scan/script.py', "userSubnets=b'MTkyLjE2OC4xLjEtMTkyLjE2OC4xLjI1NCAtLWludGVyZmFjZT1lbm8x'"]
03:10:52 [ARP Scan] In script 
03:10:52 [ARPSCAN] userSubnetsParam: 192.168.1.1-192.168.1.254 --interface=eno1
03:10:52 [Database] Opening DB
03:11:03 [Plugins] Output: [plugin_helper] reading config file
03:10:52 [ARP Scan] In script 
03:10:52 [ARPSCAN] userSubnetsParam: 192.168.1.1-192.168.1.254 --interface=eno1
03:10:52 [Database] Opening DB
03:11:03 [ARPSCAN] arpscan_output: Interface: eno1, type: EN10MB, MAC: 54:b2:03:19:8e:a5, IPv4: 192.168.1.128
Starting arp-scan 1.10.0 with 254 hosts (https://github.com/royhills/arp-scan)
192.168.1.39	60:01:94:66:ad:d1	Espressif Inc.
192.168.1.83	7c:49:eb:b1:92:2a	XIAOMI Electronics,CO.,LTD
192.168.1.69	f0:b4:29:c3:87:b6	Xiaomi Communications Co Ltd
192.168.1.33	18:de:50:bb:e7:29	(Unknown)
192.168.1.74	84:f3:eb:84:f9:a2	Espressif Inc.
192.168.1.75	84:f3:eb:84:f8:eb	Espressif Inc.
192.168.1.129	f0:2f:74:f3:76:4c	ASUSTek COMPUTER INC.
192.168.1.131	00:24:1d:27:1c:32	GIGA-BYTE TECHNOLOGY CO.,LTD.
192.168.1.132	10:62:eb:95:52:24	D-Link International
192.168.1.68	f0:b4:29:bd:ea:47	Xiaomi Communications Co Ltd
192.168.1.76	84:f3:eb:85:00:e3	Espressif Inc.
192.168.1.80	bc:dd:c2:ee:84:6e	Espressif Inc.
192.168.1.65	28:6c:07:86:a8:4a	XIAOMI Electronics,CO.,LTD
192.168.1.77	80:7d:3a:4f:49:16	Espressif Inc.
192.168.1.71	78:11:dc:dc:2f:0b	XIAOMI Electronics,CO.,LTD
192.168.1.73	84:f3:eb:85:01:7d	Espressif Inc.
192.168.1.143	e4:f0:42:01:ca:36	Google, Inc.
192.168.1.148	40:9b:cd:26:7d:88	D-Link International
192.168.1.84	40:31:3c:79:d6:59	XIAOMI Electronics,CO.,LTD
192.168.1.152	b8:27:eb:aa:b5:d2	Raspberry Pi Foundation
192.168.1.89	5c:cf:7f:bd:74:49	Espressif Inc.
192.168.1.92	34:ab:95:a7:f5:a1	Espressif Inc.
192.168.1.85	04:cf:8c:9b:3a:fd	XIAOMI Electronics,CO.,LTD
192.168.1.79	78:11:dc:91:54:b1	XIAOMI Electronics,CO.,LTD
192.168.1.182	d4:35:1d:81:2c:59	Technicolor Delivery Technologies Belgium NV
192.168.1.87	80:7d:3a:4f:49:34	Espressif Inc.
192.168.1.183	00:e0:4c:68:00:8f	REALTEK SEMICONDUCTOR CORP.
192.168.1.170	34:ce:00:e8:2d:08	XIAOMI Electronics,CO.,LTD
192.168.1.146	20:df:b9:30:55:e9	Google, Inc.
192.168.1.141	a4:77:33:bf:86:01	Google, Inc.
192.168.1.145	48:d6:d5:44:11:e8	Google, Inc.
192.168.1.144	48:d6:d5:5f:a7:c0	Google, Inc.
192.168.1.147	48:d6:d5:5e:02:40	Google, Inc.
192.168.1.158	78:11:dc:7a:24:d3	XIAOMI Electronics,CO.,LTD
192.168.1.155	3c:8d:20:45:eb:10	Google, Inc.
192.168.1.151	34:ea:34:88:df:0d	HangZhou Gubei Electronics Technology Co.,Ltd
192.168.1.153	78:11:dc:71:14:77	XIAOMI Electronics,CO.,LTD
192.168.1.176	d8:8c:79:1c:5b:68	Google, Inc.
192.168.1.163	84:cc:a8:64:7e:60	Espressif Inc.
192.168.1.254	28:d1:27:4d:c5:d1	Beijing Xiaomi Mobile Software Co., Ltd
192.168.1.186	24:24:b7:f2:85:91	(Unknown)
192.168.1.175	e8:7f:6b:aa:18:15	Samsung Electronics Co.,Ltd
192.168.1.64	28:6c:07:86:9f:fb	XIAOMI Electronics,CO.,LTD
192.168.1.72	78:11:dc:e1:f8:cd	XIAOMI Electronics,CO.,LTD
192.168.1.78	80:7d:3a:4f:48:53	Espressif Inc.
192.168.1.86	80:7d:3a:4f:4c:a3	Espressif Inc.
192.168.1.91	c4:4f:33:8b:8e:9d	Espressif Inc.
192.168.1.150	6c:5a:b5:54:e8:2a	TCL Technoly Electronics (Huizhou) Co., Ltd.
192.168.1.135	a4:f1:f8:9d:20:70 (a4:f1:e8:9d:20:70)	(Unknown)
192.168.1.160	44:ea:30:36:3b:c7	Samsung Electronics Co.,Ltd
192.168.1.142	a4:77:33:bf:88:09	Google, Inc.
192.168.1.177	9c:5a:81:ba:6a:46	Xiaomi Communications Co Ltd
192.168.1.185	22:43:ae:76:28:92	(Unknown: locally administered)
192.168.1.154	50:3e:aa:3f:a6:c9	TP-LINK TECHNOLOGIES CO.,LTD.
192.168.1.66	f0:b4:29:b8:41:1d	Xiaomi Communications Co Ltd
192.168.1.70	2c:3a:e8:43:cb:27	Espressif Inc.

57 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 254 hosts scanned in 11.163 seconds (22.75 hosts/sec). 56 responded

03:11:03 [ARPSCAN] Found: Devices without duplicates 56
03:11:03 [ARPSCAN] Devices List len:56
03:11:03 [ARPSCAN] Devices List:[{'ip': '192.168.1.39', 'mac': '60:01:94:66:ad:d1', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.83', 'mac': '7c:49:eb:b1:92:2a', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.69', 'mac': 'f0:b4:29:c3:87:b6', 'hw': 'Xiaomi Communications Co Ltd', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.33', 'mac': '18:de:50:bb:e7:29', 'hw': '(Unknown)', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.74', 'mac': '84:f3:eb:84:f9:a2', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.75', 'mac': '84:f3:eb:84:f8:eb', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.129', 'mac': 'f0:2f:74:f3:76:4c', 'hw': 'ASUSTek COMPUTER INC.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.131', 'mac': '00:24:1d:27:1c:32', 'hw': 'GIGA-BYTE TECHNOLOGY CO.,LTD.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.132', 'mac': '10:62:eb:95:52:24', 'hw': 'D-Link International', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.68', 'mac': 'f0:b4:29:bd:ea:47', 'hw': 'Xiaomi Communications Co Ltd', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.76', 'mac': '84:f3:eb:85:00:e3', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.80', 'mac': 'bc:dd:c2:ee:84:6e', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.65', 'mac': '28:6c:07:86:a8:4a', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.77', 'mac': '80:7d:3a:4f:49:16', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.71', 'mac': '78:11:dc:dc:2f:0b', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.73', 'mac': '84:f3:eb:85:01:7d', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.143', 'mac': 'e4:f0:42:01:ca:36', 'hw': 'Google, Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.148', 'mac': '40:9b:cd:26:7d:88', 'hw': 'D-Link International', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.84', 'mac': '40:31:3c:79:d6:59', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.152', 'mac': 'b8:27:eb:aa:b5:d2', 'hw': 'Raspberry Pi Foundation', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.89', 'mac': '5c:cf:7f:bd:74:49', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.92', 'mac': '34:ab:95:a7:f5:a1', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.85', 'mac': '04:cf:8c:9b:3a:fd', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.79', 'mac': '78:11:dc:91:54:b1', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.182', 'mac': 'd4:35:1d:81:2c:59', 'hw': 'Technicolor Delivery Technologies Belgium NV', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.87', 'mac': '80:7d:3a:4f:49:34', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.183', 'mac': '00:e0:4c:68:00:8f', 'hw': 'REALTEK SEMICONDUCTOR CORP.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.170', 'mac': '34:ce:00:e8:2d:08', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.146', 'mac': '20:df:b9:30:55:e9', 'hw': 'Google, Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.141', 'mac': 'a4:77:33:bf:86:01', 'hw': 'Google, Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.145', 'mac': '48:d6:d5:44:11:e8', 'hw': 'Google, Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.144', 'mac': '48:d6:d5:5f:a7:c0', 'hw': 'Google, Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.147', 'mac': '48:d6:d5:5e:02:40', 'hw': 'Google, Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.158', 'mac': '78:11:dc:7a:24:d3', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.155', 'mac': '3c:8d:20:45:eb:10', 'hw': 'Google, Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.151', 'mac': '34:ea:34:88:df:0d', 'hw': 'HangZhou Gubei Electronics Technology Co.,Ltd', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.153', 'mac': '78:11:dc:71:14:77', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.176', 'mac': 'd8:8c:79:1c:5b:68', 'hw': 'Google, Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.163', 'mac': '84:cc:a8:64:7e:60', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.254', 'mac': '28:d1:27:4d:c5:d1', 'hw': 'Beijing Xiaomi Mobile Software Co., Ltd', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.186', 'mac': '24:24:b7:f2:85:91', 'hw': '(Unknown)', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.175', 'mac': 'e8:7f:6b:aa:18:15', 'hw': 'Samsung Electronics Co.,Ltd', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.64', 'mac': '28:6c:07:86:9f:fb', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.72', 'mac': '78:11:dc:e1:f8:cd', 'hw': 'XIAOMI Electronics,CO.,LTD', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.78', 'mac': '80:7d:3a:4f:48:53', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.86', 'mac': '80:7d:3a:4f:4c:a3', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.91', 'mac': 'c4:4f:33:8b:8e:9d', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.150', 'mac': '6c:5a:b5:54:e8:2a', 'hw': 'TCL Technoly Electronics (Huizhou) Co., Ltd.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.135', 'mac': 'a4:f1:f8:9d:20:70', 'hw': '(a4:f1:e8:9d:20:70)\t(Unknown)', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.160', 'mac': '44:ea:30:36:3b:c7', 'hw': 'Samsung Electronics Co.,Ltd', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.142', 'mac': 'a4:77:33:bf:88:09', 'hw': 'Google, Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.177', 'mac': '9c:5a:81:ba:6a:46', 'hw': 'Xiaomi Communications Co Ltd', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.185', 'mac': '22:43:ae:76:28:92', 'hw': '(Unknown: locally administered)', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.154', 'mac': '50:3e:aa:3f:a6:c9', 'hw': 'TP-LINK TECHNOLOGIES CO.,LTD.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.66', 'mac': 'f0:b4:29:b8:41:1d', 'hw': 'Xiaomi Communications Co Ltd', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}, {'ip': '192.168.1.70', 'mac': '2c:3a:e8:43:cb:27', 'hw': 'Espressif Inc.', 'interface': '192.168.1.1-192.168.1.254 --interface=eno1'}]

03:11:03 [Plugins] Processing file "/app/log/plugins/last_result.ARPSCAN.log"
03:11:03 [Plugins] Processed and deleted file: /app/log/plugins/last_result.ARPSCAN.log 

Unfortunately, not very helpful. Given this only occurs for a specific device (so far) - any chance of a special version that can output debug info to a file in /tmp if and only if this MAC is seen?
(adding -v -v -v to the call in netalertx will likely cause issues)

[jonwaland]

A different device - Xiaomi Note10 mobile phone - again a single change, same place