Bug ID 1154552
Summary arp-scan shows no output (other than header and footer) from Tumbleweed snapshot 2019-10-07
Classification openSUSE
Product openSUSE Tumbleweed
Version Current
Hardware x86-64
OS openSUSE Factory
Status NEW
Severity Major
Priority P5 - None
Component Security
Assignee security-team@suse.de
Reporter paco.cruz.casado@gmail.com
QA Contact qa-bugs@suse.de
Found By ---
Blocker ---

Tumbleweed in x86_64, any snapshot from 20191007 (included) to 20191016 shows
this behavior. 

arp-scan -l 
   shows no output (other than header and footer) 

arp-scan -x -l
   shows no output at all

The packets are sent and received (you can see them with Wireshark using filter
"arp.opcode==2"), but there is no output in arp-scan.


Steps to reproduce:

(I am using tumbleweed-cli to switch between Tumbleweed snapshots)

1. Install Tumbleweed snapshot 20191004 or previous
2. Install and run "arp-scan -l" or "arp-scan -x -l" (to suppress header an
footer lines)
   you get the list of MACS - IPs active in your localnet
3. Create a snapshot with snapper, so you can rollback to it later
4. Update Tumbleweed to a snapshot newer than 20191004, or to the current
version 20191016 (at the time of this report)
5. Install Wireshark and start capturing with filter "arp.opcode==2"
(arp-replay)
5. Run "arp-scan -l" or "arp-scan -x -l" (to supres header an footer lines)
   Expected result: list of MACS - IPs active in localnet
   Obtained result: only header and footer lines (without -x option, or no
output at all with -x option).
6. Wireshark shows that arp-replay packets are received, but arp-scan does not
report the MACs - IPs.
7. Use "snapper rollback #(number)" to go back to the snapshot that you took at
step 3 (or alternatively boot from a read-only snapshot previous to the update
in step 4)
8. run "arp-scan -l" or "arp-scan -x -l" and check that you get the expected
result again. 

I am using arp-scan in a cron job to dinamically construct-update a list of
active MACs-IPs in my local net to monitor the active PCs. 
I cannot update Tumbleweed from snapshot 2019-10-04 due to this arp-scan
malfunction. 

I have tried installing a previous version or arp-scan in the updated
Tumbleweed, to not avail. 

�Any ideas?


You are receiving this mail because: