I,

If you don't need detection on the arp host machine, you can use the
keyword "ignore me = true" in the conf file.

the correct syntax in the maclist.allow are:

00:04:23:ba:27:30 195.1.4.16 eth0 ip_change
00:01:02:1e:8e:20 195.1.4.4 eth0 ip_change

arpalert can take only one mac entry by IP. the internal architecture of
arpalert doesn't permit the aliases. maybe in next major release.

Thierry

> I have a some machine in lan, which have 2 interfaces, arpalert, running
> on other pc, detecting ip_change of them every 5 minutes,
> I wrote such strings in maclist.allow
> 00:04:23:ba:27:30 195.1.4.16 eth0 ip_change
> 00:04:23:ba:27:30 10.0.0.16 eth0 ip_change
> 00:01:02:1e:8e:20 195.1.4.4 eth0 ip_change
> 00:01:02:1e:8e:20 10.0.0.4 eth0 ip_change
>
> and have no effect
>
>
> Here it is a ifconfig from that PC
> eth0 Link encap:Ethernet HWaddr 00:30:F1:05:0C:50
> inet addr:10.0.0.4 Bcast:10.0.255.255 Mask:255.255.0.0
> inet6 addr: fe80::230:f1ff:fe05:c50/64 Scope:Link
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:17560054 errors:641 dropped:1253 overruns:641
> frame:0
> TX packets:811297892 errors:0 dropped:0 overruns:18 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:1578931777 (1.4 GiB) TX bytes:455579343 (434.4 MiB)
> Interrupt:177 Base address:0xe000
>
> eth3 Link encap:Ethernet HWaddr 00:01:02:1E:8E:20
> inet addr:195.1.4.4 Bcast:195.1.4.255 Mask:255.255.255.0
> inet6 addr: fe80::201:2ff:fe1e:8e20/64 Scope:Link
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:3446167652 errors:17 dropped:0 overruns:5771
> frame:17
> TX packets:2266578390 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:1963335264 (1.8 GiB) TX bytes:4062814485 (3.7 GiB)
> Interrupt:185 Base address:0xe000
>
>
>
> --
> Çàñëàâñêèé Àíäðåé <az_at_alexbank.ru>
> ÎÀÎ Áàíê Àëåêñàíäðîâñêèé
>

-- 
To unsubscribe send a mail to list+unsubscribe_at_arpalert.org