-Index: arpwatch/arpsnmp.c
-diff -u arpwatch/arpsnmp.c:1.1.1.1.2.2 arpwatch/arpsnmp.c:1.1.1.1.2.1.6.2
---- arpwatch/arpsnmp.c:1.1.1.1.2.2 Tue Aug 10 11:14:13 2004
-+++ arpwatch/arpsnmp.c Fri Aug 13 02:17:33 2004
-@@ -63,7 +63,7 @@
- /* Forwards */
- int main(int, char **);
- int readsnmp(char *);
--int snmp_add(u_int32_t, u_char *, time_t, char *);
-+int snmp_add(u_int32_t, u_char *, time_t, char *, char *);
- __dead void usage(void) __attribute__((volatile));
-
- char *prog;
-@@ -143,22 +143,24 @@
- static time_t now;
-
- int
--snmp_add(register u_int32_t a, register u_char *e, time_t t, register char *h)
-+snmp_add(register u_int32_t a, register u_char *e, time_t t, register char *h,
-+ char *interface)
- {
- /* Watch for ethernet broadcast */
- if (MEMCMP(e, zero, 6) == 0 || MEMCMP(e, allones, 6) == 0) {
-- dosyslog(LOG_INFO, "ethernet broadcast", a, e, NULL);
-+ dosyslog(LOG_INFO, "ethernet broadcast", a, e, NULL,
-+ interface);
- return (1);
- }
-
- /* Watch for some ip broadcast addresses */
- if (a == 0 || a == 1) {
-- dosyslog(LOG_INFO, "ip broadcast", a, e, NULL);
-+ dosyslog(LOG_INFO, "ip broadcast", a, e, NULL, interface);
- return (1);
- }
-
- /* Use current time (although it would be nice to subtract idle time) */
-- return (ent_add(a, e, now, h));
-+ return (ent_add(a, e, now, h, interface));
- }
-
- /* Process an snmp file */
-Index: arpwatch/arpwatch.8
-diff -u arpwatch/arpwatch.8:1.1.1.1.2.2 arpwatch/arpwatch.8:1.1.1.1.8.5
---- arpwatch/arpwatch.8:1.1.1.1.2.2 Thu Aug 12 22:31:09 2004
-+++ arpwatch/arpwatch.8 Fri Aug 13 01:54:24 2004
-@@ -63,6 +63,13 @@
- ]
- .\" **
- .\" **
-+.br
-+.ti +8
-+[
-+.B -a
-+]
-+.\" **
-+.\" **
- .ad
- .SH DESCRIPTION
- .B Arpwatch
-@@ -127,6 +134,20 @@
- .\" **
- .\" **
- .LP
-+(Debian)
-+.B -a
-+By default,
-+.B arpwatch
-+reports bogons (unless
-+.B -N
-+is given) for IP addresses that are in the same subnet than the
-+first IP address of the default interface. If this option is
-+specified,
-+.B arpwatch
-+will report bogons about every IP addresses.
-+.\" **
-+.\" **
-+.LP
- Note that an empty
- .I arp.dat
- file must be created before the first time you run
-Index: arpwatch/arpwatch.c
-diff -u arpwatch/arpwatch.c:1.1.1.1.2.5 arpwatch/arpwatch.c:1.1.1.1.2.1.6.11
---- arpwatch/arpwatch.c:1.1.1.1.2.5 Sat Aug 14 02:33:07 2004
-+++ arpwatch/arpwatch.c Sat Aug 14 02:34:27 2004
-@@ -141,6 +141,8 @@
- int sanity_fddi(struct fddi_header *, struct ether_arp *, int);
- __dead void usage(void) __attribute__((volatile));
-
-+static char *interface;
-+
- int
- main(int argc, char **argv)
- {
-@@ -150,7 +152,7 @@
- register int fd;
- #endif
- register pcap_t *pd;
-- register char *interface, *rfilename;
-+ register char *rfilename;
- struct bpf_program code;
- char errbuf[PCAP_ERRBUF_SIZE];
- char options[] =
-@@ -172,6 +174,9 @@
- "r:"
- /**/
- /**/
-+ "a"
-+ /**/
-+ /**/
- ;
-
- if (argv[0] == NULL)
-@@ -193,6 +198,10 @@
- while ((op = getopt(argc, argv, options)) != EOF)
- switch (op) {
-
-+ case 'a':
-+ ++allsubnets;
-+ break;
-+
- case 'd':
- ++debug;
- #ifndef DEBUG
-@@ -401,29 +410,31 @@
-
- /* Watch for bogons */
- if (isbogon(sia)) {
-- dosyslog(LOG_INFO, "bogon", sia, sea, sha);
-- return;
-+ dosyslog(LOG_INFO, "bogon", sia, sea, sha, interface);
-+ if (!allsubnets) return;
- }
-
- /* Watch for ethernet broadcast */
- if (MEMCMP(sea, zero, 6) == 0 || MEMCMP(sea, allones, 6) == 0 ||
- MEMCMP(sha, zero, 6) == 0 || MEMCMP(sha, allones, 6) == 0) {
-- dosyslog(LOG_INFO, "ethernet broadcast", sia, sea, sha);
-+ dosyslog(LOG_INFO, "ethernet broadcast", sia, sea, sha,
-+ interface);
- return;
- }
-
- /* Double check ethernet addresses */
- if (MEMCMP(sea, sha, 6) != 0) {
-- dosyslog(LOG_INFO, "ethernet mismatch", sia, sea, sha);
-+ dosyslog(LOG_INFO, "ethernet mismatch", sia, sea, sha,
-+ interface);
- return;
- }
-
- /* Got a live one */
- t = h->ts.tv_sec;
- can_checkpoint = 0;
-- if (!ent_add(sia, sea, t, NULL))
-- syslog(LOG_ERR, "ent_add(%s, %s, %ld) failed",
-- intoa(sia), e2str(sea), t);
-+ if (!ent_add(sia, sea, t, NULL, interface))
-+ syslog(LOG_ERR, "ent_add(%s, %s, %ld, %s) failed",
-+ intoa(sia), e2str(sea), t, interface);
- can_checkpoint = 1;
- }
-
-@@ -550,29 +561,31 @@
-
- /* Watch for bogons */
- if (isbogon(sia)) {
-- dosyslog(LOG_INFO, "bogon", sia, sea, sha);
-- return;
-+ dosyslog(LOG_INFO, "bogon", sia, sea, sha, interface);
-+ if (!allsubnets) return;
- }
-
- /* Watch for ethernet broadcast */
- if (MEMCMP(sea, zero, 6) == 0 || MEMCMP(sea, allones, 6) == 0 ||
- MEMCMP(sha, zero, 6) == 0 || MEMCMP(sha, allones, 6) == 0) {
-- dosyslog(LOG_INFO, "ethernet broadcast", sia, sea, sha);
-+ dosyslog(LOG_INFO, "ethernet broadcast", sia, sea, sha,
-+ interface);
- return;
- }
-
- /* Double check ethernet addresses */
- if (MEMCMP(sea, sha, 6) != 0) {
-- dosyslog(LOG_INFO, "ethernet mismatch", sia, sea, sha);
-+ dosyslog(LOG_INFO, "ethernet mismatch", sia, sea, sha,
-+ interface);
- return;
- }
-
- /* Got a live one */
- t = h->ts.tv_sec;
- can_checkpoint = 0;
-- if (!ent_add(sia, sea, t, NULL))
-- syslog(LOG_ERR, "ent_add(%s, %s, %ld) failed",
-- intoa(sia), e2str(sea), t);
-+ if (!ent_add(sia, sea, t, NULL, interface))
-+ syslog(LOG_ERR, "ent_add(%s, %s, %ld, %s) failed",
-+ intoa(sia), e2str(sea), t, interface);
- can_checkpoint = 1;
- }
-
-@@ -785,6 +798,9 @@
- "[-r file] "
- /**/
- /**/
-+ "[-a] "
-+ /**/
-+ /**/
- "\n"
- ;
-
-Index: arpwatch/db.c
-diff -u arpwatch/db.c:1.1.1.1 arpwatch/db.c:1.1.1.1.8.1
---- arpwatch/db.c:1.1.1.1 Tue Apr 17 13:31:36 2001
-+++ arpwatch/db.c Fri Aug 13 02:17:33 2004
-@@ -64,6 +64,7 @@
- u_char e[6]; /* ether address */
- char h[34]; /* simple hostname */
- time_t t; /* timestamp */
-+ char i[16]; /* interface */
- };
-
- /* Address info */
-@@ -80,13 +81,14 @@
-
- static void alist_alloc(struct ainfo *);
- int cmpeinfo(const void *, const void *);
--static struct einfo *elist_alloc(u_int32_t, u_char *, time_t, char *);
-+static struct einfo *elist_alloc(u_int32_t, u_char *, time_t, char *, char *);
- static struct ainfo *ainfo_find(u_int32_t);
- static void check_hname(struct ainfo *);
- struct ainfo *newainfo(void);
-
- int
--ent_add(register u_int32_t a, register u_char *e, time_t t, register char *h)
-+ent_add(register u_int32_t a, register u_char *e, time_t t, register char *h,
-+ char *interface)
- {
- register struct ainfo *ap;
- register struct einfo *ep;
-@@ -103,7 +105,8 @@
- ep = ap->elist[0];
- if (MEMCMP(e, ep->e, 6) == 0) {
- if (t - ep->t > NEWACTIVITY_DELTA) {
-- report("new activity", a, e, NULL, &t, &ep->t);
-+ report("new activity", a, e, NULL, &t, &ep->t,
-+ interface);
- check_hname(ap);
- }
- ep->t = t;
-@@ -114,8 +117,8 @@
- /* Check for a virgin ainfo record */
- if (ap->ecount == 0) {
- ap->ecount = 1;
-- ap->elist[0] = elist_alloc(a, e, t, h);
-- report("new station", a, e, NULL, &t, NULL);
-+ ap->elist[0] = elist_alloc(a, e, t, h, interface);
-+ report("new station", a, e, NULL, &t, NULL, interface);
- return (1);
- }
-
-@@ -133,9 +136,11 @@
- if (t - t2 < FLIPFLIP_DELTA &&
- (isdecnet(e) || isdecnet(e2)))
- dosyslog(LOG_INFO,
-- "suppressed DECnet flip flop", a, e, e2);
-+ "suppressed DECnet flip flop", a, e, e2,
-+ interface);
- else
-- report("flip flop", a, e, e2, &t, &t2);
-+ report("flip flop", a, e, e2, &t, &t2,
-+ interface);
- ap->elist[1] = ap->elist[0];
- ap->elist[0] = ep;
- ep->t = t;
-@@ -151,7 +156,7 @@
- e2 = ap->elist[0]->e;
- t2 = ap->elist[0]->t;
- dosyslog(LOG_NOTICE, "reused old ethernet address",
-- a, e, e2);
-+ a, e, e2, interface);
- /* Shift entries down */
- len = i * sizeof(ap->elist[0]);
- BCOPY(&ap->elist[0], &ap->elist[1], len);
-@@ -165,12 +170,12 @@
- /* New ether address */
- e2 = ap->elist[0]->e;
- t2 = ap->elist[0]->t;
-- report("changed ethernet address", a, e, e2, &t, &t2);
-+ report("changed ethernet address", a, e, e2, &t, &t2, interface);
- /* Make room at head of list */
- alist_alloc(ap);
- len = ap->ecount * sizeof(ap->elist[0]);
- BCOPY(&ap->elist[0], &ap->elist[1], len);
-- ap->elist[0] = elist_alloc(a, e, t, h);
-+ ap->elist[0] = elist_alloc(a, e, t, h, interface);
- ++ap->ecount;
- return (1);
- }
-@@ -227,7 +232,7 @@
- for (ap = &ainfo_table[i]; ap != NULL; ap = ap->next)
- for (j = 0; j < ap->ecount; ++j) {
- ep = ap->elist[j];
-- (*fn)(ap->a, ep->e, ep->t, ep->h);
-+ (*fn)(ap->a, ep->e, ep->t, ep->h, ep->i);
- ++n;
- }
- return (n);
-@@ -259,7 +264,7 @@
- /* Allocate and initialize a elist struct */
- static struct einfo *
- elist_alloc(register u_int32_t a, register u_char *e, register time_t t,
-- register char *h)
-+ register char *h, char *interface)
- {
- register struct einfo *ep;
- register u_int size;
-@@ -286,6 +291,8 @@
- if (h != NULL && !isdigit((int)*h))
- strcpy(ep->h, h);
- ep->t = t;
-+ if (interface != NULL)
-+ strncpy(ep->i, interface, 16);
- return (ep);
- }
-
-Index: arpwatch/db.h
-diff -u arpwatch/db.h:1.1.1.1 arpwatch/db.h:1.1.1.1.8.1
---- arpwatch/db.h:1.1.1.1 Tue Apr 17 13:31:36 2001
-+++ arpwatch/db.h Fri Aug 13 02:17:33 2004
-@@ -1,10 +1,10 @@
- /* @(#) $Header$ (LBL) */
-
--typedef void (*ent_process)(u_int32_t, u_char *, time_t, char *);
-+typedef void (*ent_process)(u_int32_t, u_char *, time_t, char *, char *);
-
- #ifdef DEBUG
- void debugdump(void);
- #endif
--int ent_add(u_int32_t, u_char *, time_t, char *);
-+int ent_add(u_int32_t, u_char *, time_t, char *, char *);
- int ent_loop(ent_process);
- void sorteinfo(void);
-Index: arpwatch/file.c
-diff -u arpwatch/file.c:1.1.1.1 arpwatch/file.c:1.1.1.1.8.1
---- arpwatch/file.c:1.1.1.1 Tue Apr 17 13:31:37 2001
-+++ arpwatch/file.c Fri Aug 13 02:17:33 2004
-@@ -69,6 +69,7 @@
- u_int32_t a;
- register time_t t;
- register struct hostent *hp;
-+ char *interface;
- char line[1024];
- u_char e[6];
-
-@@ -117,6 +118,7 @@
- if (cp2 == NULL) {
- t = 0;
- h = NULL;
-+ interface = NULL;
- } else {
- t = atoi(cp2);
- h = strchr(cp2, '\t');
-@@ -126,11 +128,18 @@
- while (*cp2 != '\n' && *cp2 != '\t' &&
- *cp2 != '\0')
- ++cp2;
-+ if (*cp2 == '\t') {
-+ *cp2++ = '\0';
-+ while (*cp2 != '\n' && *cp2 != '\t' &&
-+ *cp2 != '\0') ++cp2;
-+ } else {
-+ interface = NULL;
-+ }
- *cp2 = '\0';
- }
- }
-
-- if (!(*fn)(a, e, t, h))
-+ if (!(*fn)(a, e, t, h, interface))
- return(0);
- }
-
-Index: arpwatch/file.h
-diff -u arpwatch/file.h:1.1.1.1 arpwatch/file.h:1.1.1.1.8.1
---- arpwatch/file.h:1.1.1.1 Tue Apr 17 13:31:37 2001
-+++ arpwatch/file.h Fri Aug 13 02:17:33 2004
-@@ -1,5 +1,5 @@
- /* @(#) $Header$ (LBL) */
-
--typedef int (*file_process)(u_int32_t, u_char *, time_t, char *);
-+typedef int (*file_process)(u_int32_t, u_char *, time_t, char *, char *);
-
- int file_loop(FILE *, file_process, const char *);
-Index: arpwatch/report.c
-diff -u arpwatch/report.c:1.1.1.1 arpwatch/report.c:1.1.1.1.8.1
---- arpwatch/report.c:1.1.1.1 Tue Apr 17 13:31:37 2001
-+++ arpwatch/report.c Fri Aug 13 02:17:33 2004
-@@ -233,7 +233,8 @@
-
- void
- report(register char *title, register u_int32_t a, register u_char *e1,
-- register u_char *e2, register time_t *t1p, register time_t *t2p)
-+ register u_char *e2, register time_t *t1p, register time_t *t2p,
-+ char *interface)
- {
- register char *cp, *hn;
- register int fd, pid;
-@@ -253,7 +254,7 @@
-
- if (debug) {
- if (debug > 1) {
-- dosyslog(LOG_NOTICE, title, a, e1, e2);
-+ dosyslog(LOG_NOTICE, title, a, e1, e2, interface);
- return;
- }
- f = stdout;
-@@ -270,7 +271,7 @@
- }
-
- /* Syslog this event too */
-- dosyslog(LOG_NOTICE, title, a, e1, e2);
-+ dosyslog(LOG_NOTICE, title, a, e1, e2, interface);
-
- /* Update child depth */
- ++cdepth;
-@@ -302,16 +303,19 @@
-
- (void)fprintf(f, "From: %s\n", watchee);
- (void)fprintf(f, "To: %s\n", watcher);
-+ if (interface == NULL) interface = ""; /* shouldn't happen */
- hn = gethname(a);
- if (!isdigit(*hn))
-- (void)fprintf(f, "Subject: %s (%s)\n", title, hn);
-+ (void)fprintf(f, "Subject: %s (%s) %s\n", title, hn,
-+ interface);
- else {
-- (void)fprintf(f, "Subject: %s\n", title);
-+ (void)fprintf(f, "Subject: %s %s\n", title, interface);
- hn = unknown;
- }
- (void)putc('\n', f);
- (void)fprintf(f, fmt, "hostname", hn);
- (void)fprintf(f, fmt, "ip address", intoa(a));
-+ (void)fprintf(f, fmt, "interface", interface);
- (void)fprintf(f, fmt, "ethernet address", e2str(e1));
- if ((cp = ec_find(e1)) == NULL)
- cp = unknown;
-Index: arpwatch/report.h
-diff -u arpwatch/report.h:1.1.1.1 arpwatch/report.h:1.1.1.1.8.1
---- arpwatch/report.h:1.1.1.1 Tue Apr 17 13:31:37 2001
-+++ arpwatch/report.h Fri Aug 13 02:17:33 2004
-@@ -1,3 +1,3 @@
- /* @(#) $Header$ (LBL) */
-
--void report(char *, u_int32_t, u_char *, u_char *, time_t *, time_t *);
-+void report(char *, u_int32_t, u_char *, u_char *, time_t *, time_t *, char *);
-Index: arpwatch/util.c
-diff -u arpwatch/util.c:1.1.1.1.2.2 arpwatch/util.c:1.1.1.1.8.5
---- arpwatch/util.c:1.1.1.1.2.2 Fri Aug 13 00:06:49 2004
-+++ arpwatch/util.c Fri Aug 13 02:17:33 2004
-@@ -63,11 +63,14 @@
- int initializing = 1; /* true if initializing */
- /**/
- /**/
-+int allsubnets = 0; /* watch all attached subnets */
-+/**/
-+/**/
-
- /* syslog() helper routine */
- void
- dosyslog(register int p, register char *s, register u_int32_t a,
-- register u_char *ea, register u_char *ha)
-+ register u_char *ea, register u_char *ha, char *interface)
- {
- char xbuf[64];
-
-@@ -84,23 +87,21 @@
- }
-
- if (debug)
-- fprintf(stderr, "%s: %s %s %s\n", prog, s, intoa(a), xbuf);
-+ fprintf(stderr, "%s: %s %s %s %s\n", prog, s, intoa(a),
-+ xbuf, interface);
- else
-- syslog(p, "%s %s %s", s, intoa(a), xbuf);
-+ syslog(p, "%s %s %s %s", s, intoa(a), xbuf, interface);
- }
-
- static FILE *dumpf;
-
- void
- dumpone(register u_int32_t a, register u_char *e, register time_t t,
-- register char *h)
-+ register char *h, char *interface)
- {
-- (void)fprintf(dumpf, "%s\t%s", e2str(e), intoa(a));
-- if (t != 0 || h != NULL)
-- (void)fprintf(dumpf, "\t%u", (u_int32_t)t);
-- if (h != NULL && *h != '\0')
-- (void)fprintf(dumpf, "\t%s", h);
-- (void)putc('\n', dumpf);
-+ (void)fprintf(dumpf, "%s\t%s\t%u\t%s\t%s\n", e2str(e), intoa(a),
-+ (u_int32_t)t, ((h != NULL)?h:""),
-+ ((interface != NULL)?interface:""));
- }
-
- int
-Index: arpwatch/util.h
-diff -u arpwatch/util.h:1.1.1.1.2.1 arpwatch/util.h:1.1.1.1.8.4
---- arpwatch/util.h:1.1.1.1.2.1 Fri Aug 13 00:06:49 2004
-+++ arpwatch/util.h Fri Aug 13 02:17:33 2004
-@@ -1,8 +1,8 @@
- /* @(#) $Header$ (LBL) */
-
--void dosyslog(int, char *, u_int32_t, u_char *, u_char *);
-+void dosyslog(int, char *, u_int32_t, u_char *, u_char *, char *);
- int dump(void);
--void dumpone(u_int32_t, u_char *, time_t, char *);
-+void dumpone(u_int32_t, u_char *, time_t, char *, char *);
- int readdata(void);
- char *savestr(const char *);
-
-@@ -19,3 +19,6 @@
- extern int initializing;
- /**/
- /**/
-+extern int allsubnets;
-+/**/
-+/**/