[Durham] Excluding an IP range in arpwatch

[Richard Patterson]

Hi Dougie,

The way I read the manual is that you have to give it a network address and subnet mask:

-z 192.168.1.192/255.255.255.192

Would ignore all addresses between 192 and 255

I use arpwatch all the time, but have never had the need to exclude an IP range.

Regards

Richard

-----Original Message-----
From: durham-bounces at mailman.lug.org.uk [mailto:durham-bounces at mailman.lug.org.uk] On Behalf Of Dougie Nisbet
Sent: 09 July 2012 07:21
To: North East Linux User Group mailing list
Subject: [Durham] Excluding an IP range in arpwatch

I just discovered arpwatch a few weeks ago and quite like it. I'm looking into its potential for continuous running and detecting IP conflicts. This is on 192.168.1.1-192.168.1.254 range. About half of this is in a DHCP range so I want to tell arpwatch to exclude that. 
Looking at the man page and some web sources I can see that it's the -z flag that I need, but I'm uncertain on the syntax. I don't think the man page is that clear. Discussion on the web suggests that it's a netmask required here and also that it might be necessary to precede running the command with putting some stuff in environment variables.

To cut a long question short, has anyone used arpwatch and excluded an IP range and could give me an example usage? e.g. excluding everything from 192.168.1.195 - 192.168.1.255?

Thanks

Dougie


_______________________________________________
Durham mailing list   -   Durham at mailman.lug.org.uk
https://mailman.lug.org.uk/mailman/listinfo/durham
http://www.nelug.org.uk/