.\" @(#) $Id: arpsnmp.8.in 1508 2019-12-01 19:01:07Z leres $ (LBL)
.\"
.\" Copyright (c) 1996, 1997, 1999, 2000, 2009, 2012, 2013, 2016, 2019
.\" The Regents of the University of California. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions are met:
.\"     * Redistributions of source code must retain the above copyright
.\"       notice, this list of conditions and the following disclaimer.
.\"     * Redistributions in binary form must reproduce the above copyright
.\"       notice, this list of conditions and the following disclaimer in the
.\"       documentation and/or other materials provided with the distribution.
.\"     * Neither the name of the University nor the names of its contributors
.\"       may be used to endorse or promote products derived from this software
.\"       without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
.\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd 1 December 2019
.Dt ARPSNMP 8
.Sh NAME
.Nm arpsnmp
.Nd keep track of ethernet/ip address pairings
.Sh SYNOPSIS
.Nm
.Op Fl dqs
.Op Fl D Ar arpdir
.Op Fl f Ar datafile
.Op Fl w Ar watcher@email
.Op Fl W Ar watchee@email
.Ar file ...
.Sh DESCRIPTION
.Nm
keeps track of ethernet/ip address pairings. It syslogs activity
and reports certain changes via email.
.Nm
reads information from a file (usually generated by
.Xr snmpwalk 3 ) .
.Pp
The format of the input file is the same as
.Ar arp.dat ;
the mac address, ip address, optional timestamp and optional
simple hostname. If the timestamp is missing, the current
date is used.
.Pp
.Nm
can also be used to merge
.I arp.dat
files.
If the same ethernet/ip address pair occurs in more than one
file, the timestamp from the last seen is saved.
.Pp
The
.Fl C
flag uses compact padded ethernet addresses in
.Ar arp.dat ,
e.g. 0:8:e1:1:2:d6.
.Pp
The
.Fl d
flag is used enable debugging. This also inhibits mailing the reports.
Instead, they are sent to
.Ar stderr .
.Pp
The
.Fl D
flag is used to specify the
.B arpwatch
working directory. This defaults to
.Ar /usr/local/arpwatch .
.Pp
The
.Fl f
flag is used to set the ethernet/ip address database filename.
The default is
.Ar arp.dat .
.Pp
Note that an empty
.I arp.dat
file must be created before the first time you run
.BR arpsnmp .
.Pp
The
.Fl q
flag suppresses reports being logged or printed to
.Ar stderr .
.Pp
The
.Fl s
flag suppresses reports sent by email.
.Pp
The
.Fl w
flag is used to specify the target address for email reports. The
default is
.Ar root .
.Pp
The
.Fl W
flag is used specifies the from address for email reports. The
default is
.Ar root .
.Pp
The
.Fl Z
flag uses zero padded ethernet addresses in
.Ar arp.dat ,
e.g. 00:08:e1:01:02:d6.
.Pp
.Sh "REPORT MESSAGES"
See the
.Xr arpwatch 1
man page for details on the report messages generated by
.Xr arpsnmp 1 .
.Sh FILES
.Bl -tag -width ".Pa /usr/local/arpwatch" -compact
.It Pa /usr/local/arpwatch
default directory
.It Pa arp.dat
default ethernet/ip address database
.It Pa ethercodes.dat
vendor ethernet block list
.Sh "SEE ALSO"
.Xr arpwatch 8 ,
.Xr snmpwalk 8 ,
.Xr arp 8 ,
.Sh AUTHORS
.An Craig Leres
of the
Lawrence Berkeley National Laboratory Network Research Group,
University of California, Berkeley, CA.
.Pp
The current version is available via anonymous ftp:
.Pp
.Dl Ar ftp://ftp.ee.lbl.gov/arpwatch.tar.gz
.Sh BUGS
Please send bug reports to
.Aq arpwatch@ee.lbl.gov .
.Pp
It doesn't make any sense to feed
.Nm
the
.Ar arp.dat
file.
.Pp
Attempts are made to suppress DECnet flip flops but they
aren't always successful.