Network Scan function

[GiuseppeAugiero]

Environment:

• OS name: Debian
• OS version: 12
• Architecture: amd64
• ntopng version/revision: 6.1.231201

What happened:

I have noticed some very strange behavior regarding it The environment is configured like this: Ntopng with two interfaces. The first interface without IP address is connected to a mirror port, the second interface (temporarily) in dhcp. The second interface is used to access ntopng. Arpwatch is active on the vlan where the second network interface is connected.

If I activate the "network scan" function I receive arpwatch reports of continuous flip flops, for example: hostname: ip address: XX.XX.XX.XX interface: eth1.XX ethernet address: 00:00:03:00:00:00 ethernet vendor: XEROX CORPORATION old ethernet address: 00:e0:4c:xx:xx:xx old ethernet vendor: REALTEK SEMICONDUCTOR CORP. timestamp: Friday, December 1, 2023 13:30:01 +0100 previous timestamp: Friday, December 1, 2023 13:17:02 +0100 delta: 12 minutes arpwatch reports occur every 15 minutes, exactly the interval period of network scans.

We checked that there was no other device on the network with the usual IP or with the indicated MAC address (XEROX).

By turning off the "network scan" function the problem does not arise.

[NicoMaio]

Hi @GiuseppeAugiero,

What do you mean by the "network scan" function? Are you referring to the 'Network Discovery' (Dashboard -> Network Discovery) or the IPv4 Netscan of the 'Vulnerability Scan' (Monitoring -> Vulnerability Scan)?

[MatteoBiscosi]

Closing for inactivity, please reopen if needed