Update Arpwatch ethercodes.dat file from IEEE source
I was noticing that many of the Arpwatch notification messages coming back were marked "unknown" for the manufacturer name in the MAC address lookup. I looked at the date of the file in my Ubuntu file system and it was last updated in 2012. Arpwatch uses this file to determine the manufacturer name for a given MAC address prefix. I found a script at this blog post which looked quite promising. A few simple transformations of the file downloaded direct from IEEE, updates from the comments on the blogpost and it was ready to go. I added in the lines to copy the files to the correct locations in Ubuntu's implementation of Arpwatch. Here is the updated script: Here are the basic steps and commands to do it on a terminal session. 1.Create the script using nano (copy and paste the script above) into a file called update_mac_addresses and then run it. nano ~/update_mac_addresses.sh 2. Make it executable chmod +x ~/update_mac_addresses.sh 3. Execute the script. S...