ARPSNMP (8)
keep track of ethernet/ip address pairings
SYNOPSIS
NAME
arpwatch - keep track of ethernet/ip address pairings
SYNOPSIS
arpwatch
[
-d
] [
-f
datafile
] [
-i
interface
]
[
-r
file
]
DESCRIPTION
Arpwatch
keeps track for ethernet/ip address pairings. It syslogs activity
and reports certain changes via email.
Arpwatch
uses
pcap (3)
to listen for arp packets on a local ethernet interface.
The
-d
flag is used enable debugging. This also inhibits forking into the
background and emailing the reports. Instead, they are sent to
stderr .
The
-f
flag is used to set the ethernet/ip address database filename.
The default is
arp.dat .
The
-i
flag is used to override the default interface.
The
-r
flag is used to specify a savefile
(perhaps created by
tcpdump (1)
or
pcapture (1))
to read from instead
of reading from the network. In this case,
arpwatch
does not fork.
Note that an empty
arp.dat
file must be created before the first time you run
arpwatch .
REPORT MESSAGES
FILES
/usr/operator/arpwatch - default directory
arp.dat - ethernet/ip address database
ethercodes.dat - vendor ethernet block list
SEE ALSO
AUTHORS
BUGS
Please send bug reports to arpwatch@ee.lbl.gov.
Attempts are made to suppress DECnet flip flops but they
aren't always successful.
Most error messages are posted using syslog.
$Id: atd.8.in,v 1.5 1997/04/18 12:33:20 ig25 Exp $
|