pfSense » pfSense Packages

From https://forum.netgate.com/topic/151832/suppress-arpwatch-flip-flop-emails-for-bonjour-sleep-proxy:
I just set up a new SG-3100 and want to get email notifications when a new device joins my network. Arpwatch seems the correct tool for this. However, I have a few Apple TV devices on my network, which use the Bonjour Sleep Proxy service.

The impact of this is that one or more of my apple devices (Time Capsule, Apple TV, MacBook running OSX) will respond to ARP requests for the sleeping device. From the link above: "When a sleep proxy sees an IPv4 ARP or IPv6 ND Request for one of the sleeping device's addresses, it answers on behalf of the sleeping device, without waking it up, giving its own MAC address as the current (temporary) owner of that address."

This results in frequent (every few minutes) changes in MAC Address in the arpwatch database, away from, and then back to, the sleeping device.

I see no way of suppressing alerts or configuring notifications for the arpwatch emails, either for the assigned static IP, or for Apple OUIs, or any other pattern. It looks like it's all or nothing on the email notifications. I thought I had a workaround just sending it to my gmail address and creating a rule sending some of the unwanted notifications to trash, but now google has temporarily suspended my account for the unusual traffic!