On Tue 15 Feb 2000 at 17:50:03 +0000, David Brownlee wrote:
> 	Its not a packet filter problem with rarpd - its the fact it opens
> 	the routing socket, then ignores it until too many updates build
> 	up. Could you debug arpwats and find out if its hanging on a
> 	read() on the routing socket?

Arpwatch does not use a routing socket, so that's a difference. However,
it may leave bpf messages unread for a long time, since it does reverse
name lookups a lot and this can take a long time if they don't resolve
(which happens often around here on this cable network). I'm currently
looking at this, and I hope to propose some improvements in this area to
the author of arpwatch.

> 		David/absolute
-Olaf.
--
___ Olaf 'Rhialto' Seibert - rhialto@polder.ubc.     -- If one tells the truth,
\X/ .kun.nl     -- one is sure, sooner or later, to be found out. (Oscar Wilde)