Great! That regex worked wonderfully!

Unfortunately though it seems there still isn't anything being written
to the log files. If I run it without the daemon flag I can see that it
is seeing and identifying ARP on the network but it doesn't seem to be
writing it anywhere within the /usr/local/arpalert/* structure or
/var/log/messages.

Suggestions?

Thanks!

Chad

-----Original Message-----
From: Thierry FOURNIER [mailto:thierry.fournier_at_arpalert.org]
Sent: Wednesday, April 23, 2008 6:30 PM
To: Robertson, Chad
Cc: list_at_arpalert.org
Subject: Re: [list-arpalert] flag "1208889160" not available

Hello,

This is an error in the howto. In the version 2, the leases file is not
directly compatible with the maclist.allow file.

you may use this little script

cat arpalert.leases | sed -e "s/[0-9]\{10\}.*$//" > maclist.allow

Thierry

> After copying the contents of arpalert.leases to maclist.allow using:
>
>
>
>>>>cat /usr/local/arpalert/var/lib/arpalert/arpalert.leases >
> /usr/local/arpalert/etc/arpalert/maclist.allow
>
>
>
> I receive this error when trying to start arpalert:
>
>
>
>>>>arpalert: file: "/usr/local/arpalert/etc/arpalert/maclist.allow",
> line 1: flag "1208889160" not available
>
>
>
> Here is the first line of the maclist.allow file:
>
>
>
>>>>00:1c:23:14:0f:db 172.16.2.14 eth0 1208889160 296054
>
>
>
> Thanks for your help.
>
>
> All information in this Communication is strictly confidential.
> Please view the email confidentiality statement
> http://www.imglobal.com/common/pdf/emaildisclaimer.pdf
>

-- 
To unsubscribe send a mail to list+unsubscribe_at_arpalert.org
All information in this Communication is strictly confidential.  
Please view the email confidentiality statement http://www.imglobal.com/common/pdf/emaildisclaimer.pdf
-- 
To unsubscribe send a mail to list+unsubscribe_at_arpalert.org