ARPSNMP(8)

✨ ARPSNMP(8) — keep track of ethernet/ip address pairings ✨

okay bestie, gather round: this is the manual page for arpsnmp, and it is literally here to keep track of ethernet/ip address pairings. no cap. 💅

🎀 NAME 🎀

arpsnmp — keep track of ethernet/ip address pairings

📜 SYNOPSIS 📜

arpsnmp [-dqs] [-D arpdir] [-f datafile] [-w watcher@email]
        [-W watchee@email] file ...

🌸 DESCRIPTION 🌸

okay so arpsnmp keeps track of ethernet/ip address pairings. It syslogs activity and reports certain changes via email. arpsnmp reads information from a file (usually generated by snmpwalk(3)).

The format of the input file is the same as arp.dat; the mac address, ip address, optional timestamp and optional simple hostname. If the timestamp is missing, the current date is used. slay.

arpsnmp can also be used to merge files. If the same ethernet/ip address pair occurs in more than one file, the timestamp from the last seen is saved.

here come the flags, bestie — every single one, exactly as the page gives them:

• -C — uses compact padded ethernet addresses in arp.dat, e.g. 0:8:e1:1:2:d6.
• -d — is used enable debugging. This also inhibits mailing the reports. Instead, they are sent to stderr.
• -D arpdir — is used to specify the working directory. This defaults to /usr/local/arpwatch.
• -f datafile — is used to set the ethernet/ip address database filename. The default is arp.dat.

⚠️ tiny cliffhanger note from the original: Note that an empty file must be created before the first time you run — that is exactly where the sentence stops, so I am not inventing an ending, bestie. 🫶

• -q — suppresses reports being logged or printed to stderr.
• -s — suppresses reports sent by email.
• -w watcher@email — is used to specify the target address for email reports. The default is root.
• -W watchee@email — is used specifies the from address for email reports. The default is root.
• -Z — uses zero padded ethernet addresses in arp.dat, e.g. 00:08:e1:01:02:d6.

💌 REPORT MESSAGES 💌

See the arpwatch(1) man page for details on the report messages generated by arpsnmp(1). yes, those are the exact manpage numbers in the source.

🗂️ FILES 🗂️

• /usr/local/arpwatch — default directory
• arp.dat — default ethernet/ip address database
• ethercodes.dat — vendor ethernet block list

👀 SEE ALSO 👀

arpwatch(8), snmpwalk(8), arp(8), — yes, the source has that trailing comma after arp(8), and I am keeping it. iconic. ✨

👑 AUTHORS 👑

Craig Leres of the Lawrence Berkeley National Laboratory Network Research Group, University of California, Berkeley, CA.

The current version is available via anonymous ftp:

ftp://ftp.ee.lbl.gov/arpwatch.tar.gz

💀 BUGS 💀

Please send bug reports to ⟨arpwatch@ee.lbl.gov⟩.

It doesn't make any sense to feed arpsnmp the arp.dat file.

Attempts are made to suppress DECnet flip flops but they aren't always successful.

---

mwah 💋 — this page is dated 1 December 2019 and belongs to the ARPSNMP(8) manual. that's the footer tea, bestie. bye! 🌈💖