arpwatch - constant flip flop with Apple TV3, how to disable flip flop

I've recently set up arpwatch with notifications.  It's working perfectly however every few minutes my apple TV keeps flip flopping MAC addresses.  The apple tv is wired into the network (ethernet) therefore wifi should be disabled.  Also to add, my internal Wifi has a hidden SSID as well as MAC filter and the MAC of the Apple TV isn't permitted so there's no way for it to get on the wifi.  

I have a second Apple TV that's only on wifi and doesn't flip flop.

The question in this post is how to disable flip flop entirely or for a specific device IP or set of MAC addresses.  

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Main purpose of arpwatch is to detect IP address conflicts.
Now it did.
What is the other device conflicting with your macintosh?
If you unplug the AppleTV ethernet and allow its MAC address on the wireless network, does it successfully connect without further intervention? If so, then it has the password for that SSID stored, and it may indeed make an association to the wireless network, even though your system denies it access, it still makes it into the MAC table.
If that's the case, best way is to reset the AppleTV to defaults (in the menus) and set it up again with no knowledge of the wireless network. If you'd rather not lose all your settings, then just set up a home router temporarily with some network name you'll never see around, connect the AppleTV to it, and it should then lose the other stored SSID credentials (this is not certain to work, because there is some evidence newer firmware can store multiple SSIDs). If that doesn't work, try the same as above, but set up the temporary router with the same SSID you use but a different password. Connect to it, that should overwrite the stored password.

Again, resetting to factory defaults the best route.  Good luck--
monorail1Author Commented:
@ Gheist - no, there are no IP conflicts just the same device with the same IP (x.x.x.106) showing two different MAC addresses.  All static IP devices are outside of my DHCP range.

@ Schaps - The ATV in question was never added to Wifi but I've done a reset nevertheless, no joy.  Good idea though and I appreciate the suggestion.

I will likely close this question with the solution being an email rule filtering out the keyword of "flip flop".  I was more curious in an arpwatch-based solution though if at all possible.
Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

But different MAC addresses should be getting different IPs.
Can you disable one of interfaces and set it to dhcp again?
@gheist - the wifi on an Apple TV cannot be disabled by the user, but it is effectively disabled by the device as long as an ethernet connection is maintained.

@monorail1: The only way this could be happening, then, that I can imagine, is if the AppleTV is sending out some ARP replies through its ethernet interface with its wifi MAC address, which would be an important bug potentially affecting functionality. Since it happens every few minutes, it would be interesting and fairly easy to do a packet sniff on its ethernet interface searching for that incorrect MAC coming through.

Two more ideas:
1- swap the two Apple TV's to see if the other one appears to do the same thing.

2- associate the Apple TV in question with the wifi network and allow its MAC so that it could function if the ethernet connection went down. It will then get a separate IP for that MAC and your flip-flop notifications will stop. The device will automatically prioritize its ethernet connection; this will just allow failover if something happens to the ethernet connection.

I worked at a school with about 70 Apple TV's, most connected using ethernet but having wifi configured as backup, and it worked very well.

Good luck

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
monorail1Author Commented:
@schaps - still didn't fix it but as you provided the most (and helpful) info, you'll get the points.  Cheers,
monorail1Author Commented:
Ultimately I found a workaround so this didn't resolve the issue but wanted to award the points nonetheless.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux Distributions

From novice to tech pro — start learning today.