cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Questions about Amazon Alexa devices and your Ring? Post them in our new Amazon Alexa board!

Bug: Stick Up cam sends bogus ARP response every few nights

Highlighted
New Neighbor

Bug: Stick Up cam sends bogus ARP response every few nights

Our Stick Up cam routinely disrupts our home network every few nights by sending a bogus ARP response claiming to be our router.  I suspect there's either some routine maintenance happening on the device, or possibly it's renewing its DHCP lease at the time.

 

The symptom is that my home FreeBSD server logs these messages at the time of network disconnections:

 

arp: 192.168.1.1 moved from 34:97:f6:xx:xx:xx to 54:e0:19:xx:xx:xx on em0
arp: 192.168.1.1 moved from 54:e0:19:xx:xx:xx to 34:97:f6:xx:xx:xx on em0

 

192.168.1.1 is the address of the router of course, 34:97:f6::: is the router's MAC, and 53:e0:19::: is the MAC address of the Stick Up cam.  Each time this ARP poisoning lasts only a few seconds because there's so much traffic going through the router, but it's enough to cause a disruption on the network.

 

Here are the last handful of times it has happened from the system messages:

Jun 24 20:06:08 turing kernel: arp: 192.168.1.1 moved from 34:97:f6:xx:xx:xx to 54:e0:19:xx:xx:xx on em0
Jun 24 20:06:21 turing kernel: arp: 192.168.1.1 moved from 54:e0:19:xx:xx:xx to 34:97:f6:xx:xx:xx on em0
Jun 25 01:44:16 turing kernel: arp: 192.168.1.1 moved from 34:97:f6:xx:xx:xx to 54:e0:19:xx:xx:xx on em0
Jun 25 01:44:21 turing kernel: arp: 192.168.1.1 moved from 54:e0:19:xx:xx:xx to 34:97:f6:xx:xx:xx on em0
Jul 2 01:12:20 turing kernel: arp: 192.168.1.1 moved from 34:97:f6:xx:xx:xx to 54:e0:19:xx:xx:xx on em0 Jul 2 01:12:31 turing kernel: arp: 192.168.1.1 moved from 54:e0:19:xx:xx:xx to 34:97:f6:xx:xx:xx on em0 Jul 4 03:08:11 turing kernel: arp: 192.168.1.1 moved from 34:97:f6:xx:xx:xx to 54:e0:19:xx:xx:xx on em0 Jul 4 03:08:35 turing kernel: arp: 192.168.1.1 moved from 54:e0:19:xx:xx:xx to 34:97:f6:xx:xx:xx on em0 Jul 6 01:22:24 turing kernel: arp: 192.168.1.1 moved from 34:97:f6:xx:xx:xx to 54:e0:19:xx:xx:xx on em0 Jul 6 01:22:50 turing kernel: arp: 192.168.1.1 moved from 54:e0:19:xx:xx:xx to 34:97:f6:xx:xx:xx on em0 Jul 8 02:48:44 turing kernel: arp: 192.168.1.1 moved from 34:97:f6:xx:xx:xx to 54:e0:19:xx:xx:xx on em0 Jul 8 02:49:05 turing kernel: arp: 192.168.1.1 moved from 54:e0:19:xx:xx:xx to 34:97:f6:xx:xx:xx on em0

As you can see it tends to happen in the middle of the night, and usually not more than once every two days, though on one day when we needed to reboot the cam a few times, it did it quite a bit more frequently and during the daytime.

 

This is kind of annoying, anti-social behavior on the part of the Stick Up cam... if someone had a lot of these, it could really disrupt a network.  As it happens, only the Stick Up cam does this- no other device on our network, including our Ring doorbell and Spotlight Cam, does.

 

I'm happy to send  the unredacted logs over to somebody at Ring if they want to look in more detail... in the mean time I'm going to see if our router can do some ARP response filtering from this device to prevent it from poisoning ARP caches on our network.