arpwatch - keep track of ethernet/ip address pairings


SYNOPSIS

       arpwatch [ -dN ] [ -f datafile ] [ -i interface ]
                [ -n net[/width ]] [ -r file ] [ -u username ]


DESCRIPTION

       Arpwatch  keeps track for ethernet/ip address pairings. It
       syslogs activity and reports certain  changes  via  email.
       Arpwatch uses pcap(3) to listen for arp packets on a local
       ethernet interface.

       The -d flag is used enable debugging. This  also  inhibits
       forking  into  the  background  and  emailing the reports.
       Instead, they are sent to stderr.

       The -f  flag  is  used  to  set  the  ethernet/ip  address
       database filename.  The default is arp.dat.

       The -i flag is used to override the default interface.

       The  -n flag specifies additional local networks. This can
       be useful to avoid "bogon" warnings  when  there  is  more
       than one network running on the same wire. If the optional
       width is not specified, the default netmask for  the  net­
       work's class is used.

       The -N flag disables reporting any bogons.

       The -r flag is used to specify a savefile (perhaps created
       by tcpdump(1) or pcapture(1))  to  read  from  instead  of
       reading  from the network. In this case, arpwatch does not
       fork.

       If -u flag is used, arpwatch  drops  root  privileges  and
       changes  user  ID  to username and group ID to that of the
       primary group of username.  This is recommended for  secu­
       rity reasons.

       Note that an empty arp.dat file must be created before the
       first time you run arpwatch.  Also, the default  directory
       (where  arp.dat is stored) must be owned by username if -u
       flag is used.


REPORT MESSAGES

       Here's a quick list of the report  messages  generated  by
       arpwatch(1) (and arpsnmp(1)):

       new activity
              This ethernet/ip address pair has been used for the
              first time six months or more.

              The ethernet address has not been seen before.

       flip flop
              The ethernet address  has  changed  from  the  most
              recently  seen  address to the second most recently
              seen address.  (If either the old or  new  ethernet
              address  is a DECnet address and it is less than 24
              hours, the email version  of  the  report  is  sup­
              pressed.)

       changed ethernet address
              The host switched to a new ethernet address.


SYSLOG MESSAGES

       Here  are  some of the syslog messages; note that messages
       that are reported are also sysloged.

       ethernet broadcast
              The mac ethernet address of the host is a broadcast
              address.

       ip broadcast
              The  ip address of the host is a broadcast address.

       bogon  The source ip address is not  local  to  the  local
              subnet.

       ethernet broadcast
              The source mac or arp ethernet address was all ones
              or all zeros.

       ethernet mismatch
              The source mac ethernet address  didn't  match  the
              address inside the arp packet.

       reused old ethernet address
              The  ethernet  address  has  changed  from the most
              recently seen address to  the  third  (or  greater)
              least recently seen address.  (This is similar to a
              flip flop.)

       suppressed DECnet flip flop
              A "flip flop" report was suppressed because one  of
              the two addresses was a DECnet address.


FILES

       /usr/operator/arpwatch - default directory
       arp.dat - ethernet/ip address database
       ethercodes.dat - vendor ethernet block list


SEE ALSO

       arpsnmp(8), arp(8), bpf(4), tcpdump(1), pcapture(1),
       pcap(3)

       Craig Leres of the Lawrence Berkeley  National  Laboratory
       Network  Research  Group, University of California, Berke­
       ley, CA.

       The current version is available via anonymous ftp:

              ftp://ftp.ee.lbl.gov/arpwatch.tar.gz


BUGS

       Please send bug reports to arpwatch@ee.lbl.gov.

       Attempts are made to suppress DECnet flip flops  but  they
       aren't always successful.

       Most error messages are posted using syslog.


Man(1) output converted with man2html