Index: arpwatch/arpwatch.8 diff -u arpwatch/arpwatch.8:1.1.1.1.2.2 arpwatch/arpwatch.8:1.1.1.1.6.4 --- arpwatch/arpwatch.8:1.1.1.1.2.2 Thu Aug 12 22:31:09 2004 +++ arpwatch/arpwatch.8 Thu Aug 12 22:30:19 2004 @@ -63,6 +63,13 @@ ] .\" ** .\" ** +.br +.ti +8 +[ +.B -p +] +.\" ** +.\" ** .ad .SH DESCRIPTION .B Arpwatch @@ -127,6 +134,17 @@ .\" ** .\" ** .LP +(Debian) The +.B -p +flag disables promiscuous operation. ARP broadcasts get through hubs without +having the interface in promiscuous mode, while saving considerable resources +that would be wasted on processing gigabytes of non-broadcast traffic. OTOH, +setting promiscuous mode does not mean getting 100% traffic that would concern +.B arpwatch . +YMMV. +.\" ** +.\" ** +.LP Note that an empty .I arp.dat file must be created before the first time you run Index: arpwatch/arpwatch.c diff -u arpwatch/arpwatch.c:1.1.1.1.2.5 arpwatch/arpwatch.c:1.1.1.1.2.1.4.3 --- arpwatch/arpwatch.c:1.1.1.1.2.5 Sat Aug 14 02:33:07 2004 +++ arpwatch/arpwatch.c Fri Aug 13 00:14:41 2004 @@ -172,6 +172,9 @@ "r:" /**/ /**/ + "p" + /**/ + /**/ ; if (argv[0] == NULL) @@ -223,6 +226,11 @@ break; /**/ /**/ + case 'p': + ++nopromisc; + break; + /**/ + /**/ default: usage(); } @@ -290,7 +298,7 @@ snaplen = max(sizeof(struct ether_header), sizeof(struct fddi_header)) + sizeof(struct ether_arp); timeout = 1000; - pd = pcap_open_live(interface, snaplen, 1, timeout, errbuf); + pd = pcap_open_live(interface, snaplen, !nopromisc, timeout, errbuf); if (pd == NULL) { syslog(LOG_ERR, "pcap open %s: %s", interface, errbuf); exit(1); @@ -785,6 +793,9 @@ "[-r file] " /**/ /**/ + "[-p] " + /**/ + /**/ "\n" ; Index: arpwatch/util.c diff -u arpwatch/util.c:1.1.1.1.2.2 arpwatch/util.c:1.1.1.1.6.3 --- arpwatch/util.c:1.1.1.1.2.2 Fri Aug 13 00:06:49 2004 +++ arpwatch/util.c Fri Aug 13 00:14:41 2004 @@ -63,6 +63,9 @@ int initializing = 1; /* true if initializing */ /**/ /**/ +int nopromisc = 0; /* don't activate promisc mode */ +/**/ +/**/ /* syslog() helper routine */ void Index: arpwatch/util.h diff -u arpwatch/util.h:1.1.1.1.2.1 arpwatch/util.h:1.1.1.1.6.2 --- arpwatch/util.h:1.1.1.1.2.1 Fri Aug 13 00:06:49 2004 +++ arpwatch/util.h Fri Aug 13 00:14:41 2004 @@ -19,3 +19,6 @@ extern int initializing; /**/ /**/ +extern int nopromisc; +/**/ +/**/