When arpwatch logs to syslog a typical entry can look like this: arpwatch: bogon 179.23.184.1 0:e0:a3:22:0:a0 When multiple instances of arpwatch are running on the same machine but on different ethernet cards, it is difficult to find out which arpwatch process has logged to syslog. Fix: A small patch makes the syslog message contain the pid: How-To-Repeat: I, for example, have a machine with three fxp cards. I am running: USER PID PPID VSZ RSS TT STARTED TIME COMMAND root 944 1 2372 1968 ?? 6:49AM 0:00.23 arpwatch -i fxp2 -f arp-fxp2.dat root 936 1 2372 1968 ?? 6:49AM 0:00.23 arpwatch -i fxp1 -f arp-fxp1.dat root 929 1 2368 1964 ?? 6:49AM 0:00.23 arpwatch -i fxp0 -f arp-fxp0.dat With the above syslog entry, it is very hard to determine on which of the three wires the bogon appeared and where I have to look for the user rip his head off :-)
State Changed From-To: open->closed It's more appropriate to submit a patch like this to the port's author.