Stopping ARP messages

[Paul Civati]

John Murphy <jfm at blueyonder.co.uk> wrote:

> Is there an easy way to stop the kernel reporting ARP messages?
> I see loads of these every day and I'd like to see them no more.

I'm glad I'm not the only BY user seeing these, although I don't see
them all the time.

> arp: 62.31.198.1 moved from 00:d0:ba:32:1e:54 to 00:d0:ba:32:1e:70 on ed0
> arp: 62.31.198.1 moved from 00:d0:ba:32:1e:70 to 00:d0:ba:32:1e:54 on ed0

Maybe BY are employing some kind of hot standby or load balancing
routers which means the gateway IP moves from one box to another,
hence the MAC addresses changing.

> My /etc/syslog.conf is quite standard:
> 
> *.err;kern.debug;auth.notice;mail.crit          /dev/console
> 
> How can I tell which message type they are (.err .notice .alert)?

I'm pretty sure they will be kern.* as they are at the kernel networking
level.

Having a quick search in the kernel sources finds the offending log()
statement in /usr/src/sys/netinet/if_ether.c:

  log(LOG_INFO, "arp: %s moved from %6D to %6D on %s%d\n", ...

As you have kern.debug you'll see every single class of error, so the
simplest "fix" will be to remove kern.debug from /dev/console, although
personally I think you should see kernel level warnings on the console.

Personally I would probably comment the line(s) out of the kernel source
and build a new kernel if it was bothering me that much, and leave my
syslog as is, so that I see other kernel level errors/warnings.

-Paul-