arpwatch

[Bryan Blackburn]

On Fri, Sep 26, 2008 at 01:46:20AM +0100, Mark Hattam said:
> Is there something amiss with my MacPorts system?
> 
> I did a
> sudo port install arpwatch
> 
> and it installed arpwatch into /opt/local/sbin ... just the 
> executable, no directory.
> 
> and without making a default (empty) arp.dat and without the ethercodes.dat
> 

When did you last run a 'sudo port selfupdate'?  On my system, arpwatch is
version 2.1a15 and installs more than just the arpwatch binary itself:

${prefix}/sbin/arpsnmp
${prefix}/sbin/arpwatch
${prefix}/share/examples/arpwatch-2.1a15/arp2ethers
${prefix}/share/examples/arpwatch-2.1a15/d.awk
${prefix}/share/examples/arpwatch-2.1a15/e.awk
${prefix}/share/examples/arpwatch-2.1a15/ethercodes.dat
${prefix}/share/examples/arpwatch-2.1a15/p.awk
${prefix}/share/man/man8/arpsnmp.8.gz
${prefix}/share/man/man8/arpwatch.8.gz

> It also didn't seem to complain about not installing libpcap which 
> seems to be a pre-requisite according to all the online documentation 
> about arpwatch. But arpwatch does seem to work regardless.
> 

It's apparently simply linking against the OS-installed libpcap in /usr/lib.
In theory it should probably be linking against the libpcap port.

> It would also be helpful to put in how to generate a up-to-date 
> ethercodes.dat file, not least as I had to work out how to achieve 
> this
> sh massagevendor /opt/local/sbin/oui.txt >/opt/local/sbin/ethercodes.dat
> having downloaded the oui.txt from
> http://standards.ieee.org/regauth/oui/oui.txt
> 

I'd say file a ticket against this bit as it could probably install more
files (eg, that massagevendor script at least, perhaps others).

Bryan


> (or even generate an up to date ethercodes.dat file as part of the 
> port install)
> 
> 
> Mark Hattam