From e07db917421675f62714be7c8a1da437f0f8faca Mon Sep 17 00:00:00 2001 From: Cobra Date: Tue, 14 Apr 2026 15:57:56 -0400 Subject: [PATCH] Ignore ARP replies in last_seen updates to block AP proxy spoofing AP ARP proxy sends REPLY frames with the disconnected client's MAC as the Ethernet source. Treating those as genuine device signals kept last_seen fresh, preventing the watchdog from detecting departure. Only ARP REQUEST (opcode 1) frames originate from the device itself. Skip _update_last_seen() for opcode 2 (REPLY) frames. --- net_alerter/net_alerter.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net_alerter/net_alerter.py b/net_alerter/net_alerter.py index c41a4b5..9ddc1ce 100644 --- a/net_alerter/net_alerter.py +++ b/net_alerter/net_alerter.py @@ -1540,7 +1540,11 @@ def parse_frame(data: bytes) -> None: # Branch A: ARP frame (ethertype 0x0806) if eth_type == 0x0806: - _update_last_seen(src_mac) + # Only ARP requests (opcode 1) are genuine device-originated signals. + # ARP replies (opcode 2) may be AP ARP proxy forgeries: the AP answers + # on behalf of disconnected clients with the client MAC as Ethernet source. + if len(data) >= 22 and struct.unpack('!H', data[20:22])[0] == 1: + _update_last_seen(src_mac) # Ingest ARP signal for multi-source device identity _ingest_signal(src_mac, 'arp') return