1ARPSNMP(8)                BSD System Manager's Manual               ARPSNMP(8)
2

NAME

4     arpsnmp — keep track of ethernet/ip address pairings
5

SYNOPSIS

7     arpsnmp [-dqs] [-D arpdir] [-f datafile] [-w watcher@email]
8             [-W watchee@email] file ...
9

DESCRIPTION

11     arpsnmp keeps track of ethernet/ip address pairings. It syslogs activity
12     and reports certain changes via email.  arpsnmp reads information from a
13     file (usually generated by snmpwalk(1)).
14
15     The format of the input file is the same as arp.dat; the mac address, ip
16     address, optional timestamp and optional simple hostname. If the time‐
17     stamp is missing, the current date is used.
18
19     arpsnmp can also be used to merge files.  If the same ethernet/ip address
20     pair occurs in more than one file, the timestamp from the last seen is
21     saved.
22
23     The -C flag uses compact padded ethernet addresses in arp.dat, e.g.
24     0:8:e1:1:2:d6.
25
26     The -d flag is used enable debugging. This also inhibits mailing the re‐
27     ports.  Instead, they are sent to stderr.
28
29     The -D flag is used to specify the working directory. This defaults to
30     /var/lib/arpwatch.
31
32     The -f flag is used to set the ethernet/ip address database filename.
33     The default is arp.dat.
34
35     Note that an empty file must be created before the first time you run
36
37     The -q flag suppresses reports being logged or printed to stderr.
38
39     The -s flag suppresses reports sent by email.
40
41     The -w flag is used to specify the target address for email reports. The
42     default is root.
43
44     The -W flag is used specifies the from address for email reports. The de‐
45     fault is root.
46
47     The -Z flag uses zero padded ethernet addresses in arp.dat, e.g.
48     00:08:e1:01:02:d6.
49

REPORT MESSAGES

51     See the arpwatch(8) man page for details on the report messages generated
52     by arpsnmp(8).
53

FILES

55     /var/lib/arpwatch  default directory
56     arp.dat            default ethernet/ip address database
57     ethercodes.dat     vendor ethernet block list
58

SEE ALSO

60     arpwatch(8), snmpwalk(1), arp(8),
61

AUTHORS

63     Craig Leres of the Lawrence Berkeley National Laboratory Network Research
64     Group, University of California, Berkeley, CA.
65
66     The current version is available via anonymous ftp:
67
68           ftp://ftp.ee.lbl.gov/arpwatch.tar.gz
69

BUGS

71     Please send bug reports to ⟨arpwatch@ee.lbl.gov⟩.
72
73     It doesn't make any sense to feed arpsnmp the arp.dat file.
74
75     Attempts are made to suppress DECnet flip flops but they aren't always
76     successful.
77
78                                1 December 2019
Impressum