Stefan, thank you for your patch. These androids (and also iphones who insist on broadcasting their 3g ip when switching from 3g to wifi) were driving me crazy!
The patch applied cleanly on the wheezy version, it runs fine from cli but I'm pulling my hair out trying to figure out how to properly run it from /etc/default/arpwatch. For example, my pcap filter looks like this: -F 'not ether host (MAC1 or MAC2)' and the ARGS line in /etc/default/arpwatch is ARGS="-N -p -i br0 -F 'not ether host (MAC1 or MAC2)'" When I run /etc/init.d/arpwatch with sh -x or strace, I see arpwatch apparently gets called correctly: (strace) execve("/usr/sbin/arpwatch", ["/usr/sbin/arpwatch", "-u", "arpwatch", "-N", "-p", "-i", "br0", "-F", "'not", "ether", "host", "(78:d6:f0:d3:33:f2", "or", "90:c1:15:cb:f4:6b)'"], [/* 22 vars */]) = 0 (sh -x; sh is /bin/dash) [...] + ARGS=-u arpwatch -N -p -i br0 -F 'not ether host (78:d6:f0:d3:33:f2 or 90:c1:15:cb:f4:6b)' [...] + exec start-stop-daemon --start --quiet --exec /usr/sbin/arpwatch -- -u arpwatch -N -p -i br0 -F 'not ether host (78:d6:f0:d3:33:f2 or 90:c1:15:cb:f4:6b)' However arpwatch replies with incorrect usage (note it says double quotes instead of single quote): Version 2.1a15 usage: arpwatch [-dN] [-f datafile] [-F "filter" ][-i interface] [-n net[/width]] [-r file] [-s sendmail_path] [-p] [-a] [-m addr] [-u username] [-R seconds ] [-Q] [-z ignorenet/ignoremask] Oddly enough, putting a line like exec start-stop-daemon --start --quiet --exec /usr/sbin/arpwatch -- -u arpwatch -N -p -i br0 -F 'not ether host (78:d6:f0:d3:33:f2 or 90:c1:15:cb:f4:6b)' into test.sh and running sh -x ./test.sh works fine. I'm out of ideas, any hints about what could be wrong? -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org