Question Xarp alerts

Aug 2, 2020
5
0
10
I've had xarp installed for a while and alerts come up at least once a day.
"StaticPreserveFitler: packet would overwrite a static entry for the ip address xx.xx.255.255. mac address would be changed from ff-ff-ff-ff-ff to xx-ff-xf-xx-xx."
Not sure if this is sufficient info to go off of but was wondering what im looking at here.
 
Hum....ff-ff-ff-ff-ff-ff (6 octets, not 5) is the Ethernet (layer 2) broadcast.
xx.xx.255.255 is the broadcast address for xx.xx.0.0/16 network. Are the first two octets on your network, or are they a multicast address (224.0. 0.0 to 239.255. 255.255 )?

What about the xx-ff-xf-xx-xx MAC (once again, should be 6 octets)? Is it one of your addresses?
 
Hum....ff-ff-ff-ff-ff-ff (6 octets, not 5) is the Ethernet (layer 2) broadcast.
xx.xx.255.255 is the broadcast address for xx.xx.0.0/16 network. Are the first two octets on your network, or are they a multicast address (224.0. 0.0 to 239.255. 255.255 )?

What about the xx-ff-xf-xx-xx MAC (once again, should be 6 octets)? Is it one of your addresses?
Thanks for the quick reply, forgot this was due to the vpn im using. The alerts do pop up even when I'm not using vpn so I'll update with a screenshot next time I get and alert not using the vpn.