ARP cache poisoning detection not enabling at start-up

Archive
1

Everytime I start/restart my Mac Mini (10.5.8), I see this Kernal message in my system log in the console: Could not enable ARP cache poisoning detection. Your computer will not be protected.  I've seen where a few others have noticed this, using Leopard going back to 10.5.3, to the present, and have posted on various forums, but nowhere have I seen even a stab at a helpful response.  Also, Googling the full text of the log message, I see that Leopard users soliciting help on forums for unrelated issues, who have posted their log files, have gotten this message as well.  All of them, without fail, have Symantec entries in those log files, and are using Norton Antivirus for Mac.  So do I.  I'm updated to 11.0.2.  When I've done a clean install of Leopard, without installing NAV, the message isn't there.  So... my question, at last:  Is there a known issue with NAV 11 for Mac and Leopard OS 10.5.8 (or other older versions of 10.5 as well) that wrecks the ARP cache poisoning vulnerability protection?  I don't see any other Symantec/Norton log entries of concern.  The ARP cache protection is checked (on), and messages disabled, as is the default, in NAV autoprotect prefs.  I know there were complaints of false positives from this particular feature of NAV (Mac), thus the default disabling of messages of "attacks," and I wonder if the protection/detection itself was killed by an update... did an Apple OS update kill it, or did I do something to kill it?  I don't do much messing around with my machine... just use it, so I don't know what I could have done.  I know the big issue now is Snow Leopard... but I'd like to know if some, or one, feature of NAV is bombing on Leopard as well. I realize this vulnerability isn't anything to lose sleep over, usually, but still...  one likes to get the benefits of the software bought and installed for protection, and if something appears to not be working ("your computer will not be protected"), some answer or general notice to customers would be cool.

 

Also, unrelated, I've got my Snow Leopard disc... just waiting for the NAV update.  Will I have to uninstall & reinstall, or just run live update, when the fix is available, before installing the Snow update (or after installing the update)?

Thanks,

J

2

I believe that error message is in fact, an error. If you happen to have VMWare or Parallels installed, or any other software which installs a software NIC device, Mac OS X started returning errors when we attach to those fake NIC devices some time ago causing ARP cache poisoning detection to print out that message. But that's as-designed; software NIC devices don't need ARP protection because they are not on the actual network.

 

I believe the next version of Vulnerability Protection, scheduled for release later this year, will no longer attach to software NIC devices. But it's nothing to be worried about. 

 

Note this message can also occur if you have more than 2 NIC devices, such as a USB Ethernet adapter. This is also corrected in the update.

3

I’m not too sharp about these things, but have done some reading online…  as far as I know, I don’t have VMware or Parallels installed, unless either come with the OS (10.5.8).  I didn’t install either, or anything, other than Leopard and updates, ILife 09, Office 2004, Epson scanner & printer software, and NAV, and all of these were installed on an erased disc, freshly, two days ago.  Bootcamp comes with the the OS, and Apple Remote, but I don’t know if a software NIC device is installed.  I’m not in front of the Mini (at work), and can’t see the number of NIC devices.  I don’t have anything connected via a USB Ethernet adapter, but perhaps the Mini has a USB card with it’s own MAC address?  I know there is the airport and the ethernet, but don’t know what, if anything, else is there.   At any rate, I thank you for jumping in so quickly with an answer, even if I’m too daft to know if any of those causes would apply to me.

4

I think there are three mac addresses, or IDs (airport, ethernet, bluetooth), but again, I'm not at home to look, and I'm not even sure if that has anything to do with the issues that you said could cause this error of an error.

Thanks again,

J