arpwatch

[Mark Hattam]

At 19:56 -0600 25/9/08, Bryan Blackburn wrote:
>On Fri, Sep 26, 2008 at 01:46:20AM +0100, Mark Hattam said:
>>  Is there something amiss with my MacPorts system?
>>
>>  I did a
>>  sudo port install arpwatch
>>
>>  and it installed arpwatch into /opt/local/sbin ... just the
>>  executable, no directory.
>>
>>  and without making a default (empty) arp.dat and without the ethercodes.dat
>>
>
>When did you last run a 'sudo port selfupdate'?  On my system, arpwatch is
>version 2.1a15 and installs more than just the arpwatch binary itself:

Yes, I installed 2.1a15 ... I do a selfupdate everytime before doing 
anything with "port".


>${prefix}/sbin/arpsnmp
>${prefix}/sbin/arpwatch
>${prefix}/share/examples/arpwatch-2.1a15/arp2ethers
>${prefix}/share/examples/arpwatch-2.1a15/d.awk
>${prefix}/share/examples/arpwatch-2.1a15/e.awk
>${prefix}/share/examples/arpwatch-2.1a15/ethercodes.dat
>${prefix}/share/examples/arpwatch-2.1a15/p.awk
>${prefix}/share/man/man8/arpsnmp.8.gz
>${prefix}/share/man/man8/arpwatch.8.gz

Ah ... I see these too ... but I wouldn't have known to go searching here.

And running
man arpwatch doesn't bring up the manual.

Also running arpwatch it doesn't find ethercodes.dat for itself. I 
had to move (and later update) ethercodes.dat in the /opt/local/sbin 
directory alongside arpwatch itself. And there is no arp.dat file 
created by the installer process. Nor is there the massagevendors 
script for future updating of a current oui.txt from ieee.

Powerbook:/opt/local/sbin markhattam$ ls -la
total 1072
drwxr-xr-x   12 root      admin        408 Sep 26 08:20 .
drwxr-xr-x   12 root      admin        408 Jul 31 23:10 ..
-rw-r--r--    1 root      admin          0 Dec 17  2007 .turd_MacPorts
-rw-r--r--    1 root      admin        117 Sep 26 08:20 arp.dat
-rw-r--r--    1 root      admin        117 Sep 26 08:16 arp.dat-
-r-xr-xr-x    2 root      admin      29732 Sep 25 00:17 arpsnmp
-r-xr-xr-x    2 root      admin      34944 Sep 25 00:17 arpwatch
-rw-r--r--    1 markhatt  markhatt  342651 Sep 26 01:28 ethercodes.dat
-rwxr-xr-x    2 root      admin      15312 Aug  1 13:12 pwcheck
-rwxr-xr-x    2 root      admin      63504 Aug  1 13:12 saslauthd
-rwxr-xr-x    2 root      admin      23764 Aug  1 13:12 sasldblistusers2
-rwxr-xr-x    2 root      admin      19640 Aug  1 13:12 saslpasswd2




>  > It also didn't seem to complain about not installing libpcap which
>  > seems to be a pre-requisite according to all the online documentation
>>  about arpwatch. But arpwatch does seem to work regardless.
>>
>
>It's apparently simply linking against the OS-installed libpcap in /usr/lib.
>In theory it should probably be linking against the libpcap port.

Isn't it MacPorts policy to build necessary linked software itself 
rather than rely on Apple installations?



>  > It would also be helpful to put in how to generate a up-to-date
>>  ethercodes.dat file, not least as I had to work out how to achieve
>>  this
>>  sh massagevendor /opt/local/sbin/oui.txt >/opt/local/sbin/ethercodes.dat
>>  having downloaded the oui.txt from
>>  http://standards.ieee.org/regauth/oui/oui.txt
>>
>
>I'd say file a ticket against this bit as it could probably install more
>files (eg, that massagevendor script at least, perhaps others).
>
>Bryan
>
>
>>  (or even generate an up to date ethercodes.dat file as part of the
>  > port install)


Mark