Red Hat Bugzilla – Bug 186630
arpwatch does not parse ethercodes.dat correctly
Last modified: 2007-11-30 17:11:28 EST
Description of problem:
Installed arpwatch 14:2.1a13-14.1.2 from FC5 repository. Started installation
and get the following for all systems found on the network:
ip address: 192.168.1.5
ethernet address: 0:b0:d0:dd:b3:d1
ethernet vendor: <unknown>
timestamp: Thursday, March 23, 2006 18:22:17 -0700
Should have come up as owned by Dell. Looking at the
/var/arpwatch/ethercodes.dat the entry shows
0:b0:d0 Dell Computer Corp.
Should have reported the system as Dell Computer Corp as it does in FC3.
Do you have any idea how to reproduce it? It works for me fine...
I did a fresh install of FC5 with arpwatch. I put the box onto my Linksys WRTG55
router, and did updates. I set up root to aliases to my google.com account. I
started arpwatch and looked at the results. Got what I sent you. I removed
arpwatch and put it back in.. same problem. Changed out the ethercodes.dat with
an updated one.. still same problem.
Would an strace help any.. I am not thinking it would
Bug went away on system after new kernel. I dont think the kernel is the reason
it went away.. but it and the selinux patches are the only updates that have
Going to close this as 'stupid computers like me to open useless bugzilla reports'