arpwatch

[Ryan Schmidt]

On Sep 26, 2008, at 02:30, Mark Hattam wrote:

> At 19:56 -0600 25/9/08, Bryan Blackburn wrote:
>> On Fri, Sep 26, 2008 at 01:46:20AM +0100, Mark Hattam said:
>>>  Is there something amiss with my MacPorts system?
>>>
>>>  I did a
>>>  sudo port install arpwatch
>>>
>>>  and it installed arpwatch into /opt/local/sbin ... just the
>>>  executable, no directory.
>>>
>>>  and without making a default (empty) arp.dat and without the  
>>> ethercodes.dat
>>>
>>
>> When did you last run a 'sudo port selfupdate'?  On my system,  
>> arpwatch is
>> version 2.1a15 and installs more than just the arpwatch binary  
>> itself:
>
> Yes, I installed 2.1a15 ... I do a selfupdate everytime before doing
> anything with "port".
>
>
>> ${prefix}/sbin/arpsnmp
>> ${prefix}/sbin/arpwatch
>> ${prefix}/share/examples/arpwatch-2.1a15/arp2ethers
>> ${prefix}/share/examples/arpwatch-2.1a15/d.awk
>> ${prefix}/share/examples/arpwatch-2.1a15/e.awk
>> ${prefix}/share/examples/arpwatch-2.1a15/ethercodes.dat
>> ${prefix}/share/examples/arpwatch-2.1a15/p.awk
>> ${prefix}/share/man/man8/arpsnmp.8.gz
>> ${prefix}/share/man/man8/arpwatch.8.gz
>
> Ah ... I see these too ... but I wouldn't have known to go  
> searching here.

"port contents arpwatch" will show you everything arpwatch installed.


> And running
> man arpwatch doesn't bring up the manual.

It does on my system. Your MANPATH environment variable must not be  
set up correctly.


> Also running arpwatch it doesn't find ethercodes.dat for itself. I
> had to move (and later update) ethercodes.dat in the /opt/local/sbin
> directory alongside arpwatch itself. And there is no arp.dat file
> created by the installer process. Nor is there the massagevendors
> script for future updating of a current oui.txt from ieee.

You should file tickets for these issues and assign them to the  
port's maintainer.

As you probably know, it's unusual to have configuration or data  
files in ${prefix}/sbin; that directory is only for programs you run.  
Hopefully there's a better place these files can be put and still  
found by arpwatch. Configuration files would usually go somewhere  
under ${prefix}/etc, data files somewhere under ${prefix}/share.


>>> It also didn't seem to complain about not installing libpcap which
>>> seems to be a pre-requisite according to all the online  
>>> documentation
>>>  about arpwatch. But arpwatch does seem to work regardless.
>>>
>>
>> It's apparently simply linking against the OS-installed libpcap  
>> in /usr/lib.
>> In theory it should probably be linking against the libpcap port.
>
> Isn't it MacPorts policy to build necessary linked software itself
> rather than rely on Apple installations?

Yes, it is, and this port seems to be in violation of that policy.  
Please file a ticket. :)