From: [email protected]

Marius Gedminas wrote...

If the network interface goes down, arpwatch dies silently without
cleaning up its pid file. Ideally I'd prefer arpwatch to keep running, waiting for the interface to come back up, but if that's not possible,
I'd settle for a syslog message.

The pid file is actually written in /etc/init.d/arpwatch and from there
it's not easy to detect that a certain arpwatch instance has terminated.
This would require moving the pid file writing, arpwatch.conf parsing,
forking etc. to arpwatch itself or a launching program.

Concerning syslog, I see a "arpwatch: pcap_loop: recvfrom: Network is
down" message here, although an interface name would be fine here.
Fixed.

The patch attached adds an -R <seconds> option that will retry after the
given number of seconds if the interface is down at startup or goes down
during operation. Please test thoroughly.

NOTE: This patch includes the small one I've sent in earlier today for
#140504 since the Debian Builds System cannot handle two independant
patches concerning adjacent lines.

Christoph

diff -ur ORG/arpwatch.8 PATCH/arpwatch.8
--- ORG/arpwatch.8 2004-08-13 09:58:45.000000000 +0200
+++ PATCH/arpwatch.8 2004-08-13 13:57:01.000000000 +0200
@@ -51,6 +51,9 @@
]] [
.B -r
.I file
+] [
+.B -R
+.I sleep_time
]
.br
.ti +8
@@ -132,6 +135,11 @@
YMMV. (Debian specific)
.LP
The
+.B -R
+flag causes arpwatch to try again after the given number of seconds
+if the interface is down. (Debian specific)
+.LP
+The
.B -r
flag is used to specify a savefile
(perhaps created by
diff -ur ORG/arpwatch.c PATCH/arpwatch.c
--- ORG/arpwatch.c 2004-08-13 15:35:39.000000000 +0200
+++ PATCH/arpwatch.c 2004-08-13 15:34:56.000000000 +0200
@@ -112,6 +112,10 @@
int can_checkpoint;
int swapped;
int nobogons;
+/* restart arpwatch if interface is down?
+ * non-zero: seconds to sleep before restarting */
+static int restart = 0;
+

static u_int32_t net;
static u_int32_t netmask;
@@ -184,6 +188,7 @@
"N"
"p"
"r:"
+ "R:"
"s:"
"u:"
;
@@ -248,6 +253,10 @@
rfilename = optarg;
break;

+ c