Arpalert

Mailing list

you can send questions at:
Read the archives
Subscribe to the list:

Supported and tested platforms

Linux 2.4 on x86
Solaris 8 on UltraSPARC-IIi
Solaris 10 on x86
FreeBSD 5.4 on x86
OpenBSD 3.7 on x86
NetBSD 3.0 on x86

New branche 2.0: what's new ?

• version 2.0.11 (stable): (31/03/2008)
  Don't erase configure when make mrproper is calledw
  Update error in man
  minor orthographic correction in doc
• version 2.0.10 (stable): (28/03/2008)
  bug into leases file reading
  new script in contribs by mikuskuikku
  (found here: http://ubuntuforums.org/showthread.php?t=464883)
  this script send a zenity alert on Ubuntu.
• version 2.0.9 (stable): (17/11/2007)
  fix an error message
  update script API documentation
  API documentation
  new API functions : mod conf
  set lockfile optional
• version 2.0.8 (stable): (27/08/2007)
  Install API includes
  close and reopen the logfile on SIGHUP
  change type of ip arg passed to module
  bugfix in module options
• version 2.0.7 (stable): (03/08/2007)
  minor openbsd bugfix (thanks Andy)
  very minor code optimization
  check string representation of mac adress memory size
  allocate static memory for many buffers
  openbsd Makefile compatibility
• version 2.0.6 (stable): (07/06/2007)
  default config file syntax correction and comments
  display list of mac vendor loaded only in debug compil mode
  add vim syntax file
  would not require manually editing the script to fix the sender and receiver's email adress.
• version 2.0.5 (stable): (12/03/2007)
  bugfix in arp selftest detection
  bugfix in scheduler
  code cleanup
  
• version 2.0.4 (stable): (05/02/2007)
  segfault when config is dumped
  compilation error on ppc processors (sign error)
  
• version 2.0.3 (beta): (24/11/2006)
  man corrections
  arpalert don't quit if the leases file is not found at start. just send an notice.
  variable type correction
  alerts identifiers defined
  alert bug in "reference" field
  put also mac address without ip in leases file
  
• version 2.0.2 (beta): (04/11/2006)
  serialization of sigchld signal and sigkill, sighup
  option for force run in foreground
  update man
  
• version 2.0.1 (beta): (29/10/2006)
  retrieve mac vendor name
  load leases files and remember the mac already discovered
  port on solaris8 ultrasparc IIi
  reload "white list", "black list", "authorizations" and "oui.txt" when a sighup is received
  generalise use of errno
  code cleaning
  change install system
  generate default config
  scheduler bug in dump leases time
  launch a laeses file dump before quit
  
• version 2.0.0 (beta): (16/10/2006)
  permit to listen more than one interface
  port on solaris10
  analyse arp reply (usefull if the arpalert is running on router)
  format of config files updated for use of the ethernet interfaces name
  the option "ignore me" is only used for the "unauth_rq" alerts
  new debug format (like tcpdump trace)
  new core sheduler for more speed
  all internal times in µseconds (in place of seconds)
  change internal storage structurs for more speed
  clean configure.in file
  new defines for more code readability
  

New branche 1.0: what's new ?

• version 1.1.3 (stable): (12/10/2006)
  minor bugfix: harmonie of file arpalert.lock
  minor change in arpalert.8
• version 1.1.2: (12/10/2006)
  bug in config whith "" file notation
• version 1.1.1: (06/10/2006)
  little bug in syntax of config file
• version 1.1.0: (05/10/2006)
  new function: permit to listen only ARP traffic (alert new_mac disabled)
  new function: permit to call a .so extension
  normalize code with use "struct in_addr" for the ip address
  normalize code with use "struct ether_header" for the mac address
  normalize code with use "struct arphdr" for decoding ethernet header
  changing hash algoritm for homogeneously reparttion of mac adresses
  normalize macro case
  change test for testing bitfield
  flood alert: remove parameter
  mac change alert: add parameter
  add api for mod alerts
  clean code
• version 1.0.3: (01/09/2006)
  add option -V to return arpalert version
  syntax updates in man
  change condition order in alert detection routine
  change log syntax for the loading file function
  bug in parsing of config file
  bug in mac change detection
  bug in ip change detection
• version 1.0.2 (beta): (11/05/2006)
  complete inline help
  minor security fix: changes from sprintf to snprintf in data.c
  minor bugfix in compilation in debug code
  add header at file arpalert.h
  add header at sens_timeouts.c (for mac OS X)
  add copyright informations at file arpalert.h
• version 1.0.1 (beta): (10/05/2006)
  error in log format for "unknow_address" alert
  error in pid structur initialization
• version 1.0.0 (beta): (09/05/2006)
  rewrite detection code.
  rewrite data storage code.
  rewrite pid gestion code.
  possibility to write comments in allow / deny files.
  possibility to ignore mac only new detection
  possibility to ignore certains types of detection by mac address (solution for ip alias)
  add new detection function: detect mac change
  add exemple mail alert script.
  add $DESTDIR variable in Makefile.
  add suse start script
  add FC4 start script
  add 2 management scripts

Stable version 0.4: what's new ?

• version 0.4.15-2: (03/11/2006)
  bugfix: bug zombies
  version 0.4.15-1: (01/08/2006)
  bugfix: new mac detection error
  version 0.4.15: (28/11/2005)
  bugfix: probleme in function data_cmp
  rewrite many parts of code.
• version 0.4.14: (14/11/2005)
  Anti flood system for unauthorized detection by couple mac sender / ip requested. This system permit to watch all alerts.
  Anti flood system only by mac sender is also available.
  Unauthorized request configuration file format change. Now accept the syntax with network mask.
• version 0.4.13: (01/11/2005)
  command line errors more verbose
  bugfix: Command line bug with -f parameter corrected
• version 0.4.12: (30/10/2005
  unauthorized request detection: possibility to ignore self request generated by windows dhcp client
  unauthorized request file support comment every where
  when the program is not running in deamon mode, the logs are displayed on standard output
  bugfix: segfault problem in sens_hash
  bugfix: segfault in debug message
  bugfix: error in log function
• version 0.4.11: (10/10/2005)
  Use priveleges separation
  Use chroot
  Apply mask on files
  Port on openbsd, freebsd, netbsd
• version 0.4.10: (19/07/2005)
  I write the man
• version 0.4.9: (19/07/2005)
  Reload the authorized_request list if the SIGHUP is send
• version 0.4.8: (11/07/2005)
  Don't quit the program with if the link is down ... they're attempt to reconnect
• version 0.4.7: (10/07/2005)
  Send an alert code 8 if the new mac adress is detected whithout his ip address
• version 0.4.6: (30/06/2005)
  Launched floods alerts scripts also if the numbers of launched scripts are excedant
  Detect global flood
  Min time from two sames alert (mac source, type of alert)
  Don't alert if the mac adress is the mac of the listening interface
• version 0.4.5: (26/06/2005)
  Invalid mac address detection based on ethernet header.
  Detection of different address from ethernet header to arp request.
• version 0.4.4: (16/06/2005)
  Conceptual error in non authorized Arp request detection.
  The requestor are now designed by his mac adress (replace the ip address).
• version 0.4.3: (09/06/2005)
  A little function in unauthorized request detection: the target 255.255.255.255 permit to ignore a mac adress
  
• version 0.4.2: (05/06/2005)
  Detection of non authorized Arp request
  
• version 0.4.1: (17/04/2005)
  Patch many bugs (error in set signals)
• version 0.4.0: (12/04/2005)
  Patch many bugs
  Use white list / black list
  Learn network and stock result in leases file
  More configuration options
  More options in command line
  Translated to english (only logs messages)
  Lesson must than one interface

Stable version 0.3: what's new ?

• version 0.3.4:
  First stable realease
  

Compilation / Installation:

• --with-syslog: Use the SysLog system. (enabled by default)
• --enable-debug: The logs are more verbose. (disabled by default)
• --prefix: Installation directory (by default: /opt/arpalert)