> For example, my pcap filter looks like this:
> -F 'not ether host (MAC1 or MAC2)'
> and the ARGS line in /etc/default/arpwatch is
> ARGS="-N -p -i br0 -F 'not ether host (MAC1 or MAC2)'"
>
> When I run /etc/init.d/arpwatch with sh -x or strace, I see arpwatch
> apparently gets called correctly:
>
> (strace)
> execve("/usr/sbin/arpwatch", ["/usr/sbin/arpwatch", "-u", "arpwatch",
> "-N", "-p", "-i", "br0", "-F", "'not", "ether", "host",
> "(78:d6:f0:d3:33:f2", "or", "90:c1:15:cb:f4:6b)'"], [/* 22 vars */]) =
> 0
Actually that is wrong, it should be:
... "br0", "-F", "'not ether host .... 6b)"
> + exec start-stop-daemon --start --quiet --exec /usr/sbin/arpwatch --
> -u arpwatch -N -p -i br0 -F 'not ether host (78:d6:f0:d3:33:f2 or
> 90:c1:15:cb:f4:6b)'
see below
> I'm out of ideas, any hints about what could be wrong?
arpwatch should log what filter it want's to use, and you should see something
like
using filter '(arp or rarp) and not'
note the missing "ether host ..."
Could you try replacing the exec start-stop-daemon call with eval, e.g.:
eval start-stop-daemon --start ...
Stefan
--
BOFH excuse #171:
NOTICE: alloc: /dev/null: filesystem full
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
