There wasn't arpwatch package in the list, so I put it to tcpdump.. RH6.0 arpwatch package's arp2ethers script seems to be broken; it just prints the usage of awk here. This seemed to fix it: --- arp2ethers Mon Mar 22 07:15:36 1999 +++ arp2ethers_ Tue Aug 3 07:29:01 1999 @@ -14,7 +14,7 @@ # sort +2rn arp.dat | \ - awk -e 'NF == 4 { print }' | \ + awk 'NF == 4 { print }' | \ awk -f p.awk | \ egrep -v '\.[0-9][0-9]*$' | \ sed -e 's/ .* / /' | \
Fixed in tcpdump-3.4-11. Thanks for the patch.