Index: arpwatch/arpwatch.8 diff -u arpwatch/arpwatch.8:1.1.1.1.2.2 arpwatch/arpwatch.8:1.1.1.1.24.2 --- arpwatch/arpwatch.8:1.1.1.1.2.2 Thu Aug 12 22:31:09 2004 +++ arpwatch/arpwatch.8 Thu Aug 12 23:44:44 2004 @@ -63,6 +63,14 @@ ] .\" ** .\" ** +.br +.ti +8 +[ +.B -z +.I ignorenet/ignoremask +] +.\" ** +.\" ** .ad .SH DESCRIPTION .B Arpwatch @@ -127,6 +135,13 @@ .\" ** .\" ** .LP +(Debian) The +.B -z +flag is used to set a range of ip addresses to ignore (such as a DHCP +range). Netmask is specified as 255.255.128.0. +.\" ** +.\" ** +.LP Note that an empty .I arp.dat file must be created before the first time you run Index: arpwatch/arpwatch.c diff -u arpwatch/arpwatch.c:1.1.1.1.2.5 arpwatch/arpwatch.c:1.1.1.1.2.1.14.6 --- arpwatch/arpwatch.c:1.1.1.1.2.5 Sat Aug 14 02:33:07 2004 +++ arpwatch/arpwatch.c Fri Aug 13 02:40:20 2004 @@ -123,6 +123,9 @@ static int nets_ind; static int nets_size; +static struct in_addr ignore_net; +static struct in_addr ignore_netmask; + extern int optind; extern int opterr; extern char *optarg; @@ -172,7 +175,11 @@ "r:" /**/ /**/ + "z:" + /**/ + /**/ ; + char *tmpptr; if (argv[0] == NULL) prog = "arpwatch"; @@ -190,6 +197,9 @@ interface = NULL; rfilename = NULL; pd = NULL; + + inet_aton("0.0.0.0", &ignore_netmask); + inet_aton("255.255.255.255", &ignore_netmask); while ((op = getopt(argc, argv, options)) != EOF) switch (op) { @@ -223,6 +233,14 @@ break; /**/ /**/ + case 'z': + tmpptr = strtok(optarg, "/"); + inet_aton(tmpptr, &ignore_net); + tmpptr = strtok(NULL, "/"); + inet_aton(tmpptr, &ignore_netmask); + break; + /**/ + /**/ default: usage(); } @@ -418,7 +436,15 @@ return; } + /* Ignores the specified netmask/metwork */ + if ((sia & ignore_netmask.s_addr) == ignore_net.s_addr) { + if (debug) { + dosyslog(LOG_INFO, "ignored", sia, sea, sha, interface); + } + return; + } /* Got a live one */ + t = h->ts.tv_sec; can_checkpoint = 0; if (!ent_add(sia, sea, t, NULL)) @@ -785,6 +811,9 @@ "[-r file] " /**/ /**/ + "[-z ignorenet/ignoremask] " + /**/ + /**/ "\n" ;