Index: arpwatch/arpwatch.8 diff -u arpwatch/arpwatch.8:1.1.1.1 arpwatch/arpwatch.8:1.1.1.1.6.1 --- arpwatch/arpwatch.8:1.1.1.1 Tue Apr 17 13:31:36 2001 +++ arpwatch/arpwatch.8 Tue Apr 17 13:50:23 2001 @@ -29,6 +29,8 @@ [ .B -dN ] [ +.B -p +] [ .B -f .I datafile ] [ @@ -81,6 +83,15 @@ The .B -N flag disables reporting any bogons. +.LP +The +.B -p +flag disables promiscuous operation. ARP broadcasts get through hubs without +having the interface in promiscuous mode, while saving considerable resources +that would be wasted on processing gigabytes of non-broadcast traffic. OTOH, +setting promiscuous mode does not mean getting 100% traffic that would concern +.B arpwatch . +YMMV. (Debian specific) .LP The .B -r Index: arpwatch/arpwatch.c diff -u arpwatch/arpwatch.c:1.1.1.1.2.1 arpwatch/arpwatch.c:1.1.1.1.2.1.4.1 --- arpwatch/arpwatch.c:1.1.1.1.2.1 Tue Apr 17 13:47:57 2001 +++ arpwatch/arpwatch.c Tue Apr 17 13:50:23 2001 @@ -159,6 +159,7 @@ "i:" "n:" "N" + "p" "r:" ; @@ -206,6 +207,10 @@ ++nobogons; break; + case 'p': + ++nopromisc; + break; + case 'r': rfilename = optarg; break; @@ -277,7 +282,7 @@ snaplen = max(sizeof(struct ether_header), sizeof(struct fddi_header)) + sizeof(struct ether_arp); timeout = 1000; - pd = pcap_open_live(interface, snaplen, 1, timeout, errbuf); + pd = pcap_open_live(interface, snaplen, !nopromisc, timeout, errbuf); if (pd == NULL) { syslog(LOG_ERR, "pcap open %s: %s", interface, errbuf); exit(1); @@ -758,6 +763,7 @@ extern char version[]; char usage[] = "[-dN] " + "[-p] " "[-f datafile] " "[-i interface] " "[-n net[/width]] " Index: arpwatch/util.c diff -u arpwatch/util.c:1.1.1.1 arpwatch/util.c:1.1.1.1.6.1 --- arpwatch/util.c:1.1.1.1 Tue Apr 17 13:31:37 2001 +++ arpwatch/util.c Tue Apr 17 13:50:23 2001 @@ -61,6 +61,7 @@ int debug = 0; int initializing = 1; /* true if initializing */ +int nopromisc = 0; /* don't activate promisc mode */ /* syslog() helper routine */ void Index: arpwatch/util.h diff -u arpwatch/util.h:1.1.1.1 arpwatch/util.h:1.1.1.1.6.1 --- arpwatch/util.h:1.1.1.1 Tue Apr 17 13:31:37 2001 +++ arpwatch/util.h Tue Apr 17 13:50:23 2001 @@ -17,3 +17,4 @@ extern int debug; extern int initializing; +extern int nopromisc;