[packages/arpwatch] Restore the custom pcap filter option as -B

[arekm]

commit 3c0ea22dfba0a791aeee172ce27dc6a36ea3d9b1
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Sun Aug 16 20:54:24 2026 +0200

    Restore the custom pcap filter option as -B
    
    It came from the Debian patchset as -F, which 3.9 uses for the foreground
    flag.

 arpwatch-filter.patch | 85 +++++++++++++++++++++++++++++++++++++++++++++++++++
 arpwatch.spec         |  2 ++
 arpwatch.sysconfig    |  4 ++-
 3 files changed, 90 insertions(+), 1 deletion(-)
---
diff --git a/arpwatch.spec b/arpwatch.spec
index 66fa463..8212ac0 100644
--- a/arpwatch.spec
+++ b/arpwatch.spec
@@ -31,6 +31,7 @@ Patch8:		%{name}-arpfetch.patch
 Patch9:		%{name}-path.patch
 Patch10:	%{name}-quiet.patch
 Patch11:	%{name}-nolocal.patch
+Patch12:	%{name}-filter.patch
 URL:		https://ee.lbl.gov/
 BuildRequires:	autoconf >= 2.71
 BuildRequires:	libpcap-devel
@@ -77,6 +78,7 @@ Dodatkowo tworzona jest baza par adresów ethernet/IP.
 %patch -P9 -p1
 %patch -P10 -p1
 %patch -P11 -p1
+%patch -P12 -p1
 
 # the database directory is hardwired in the manuals and scripts
 %{__sed} -i -e 's|/usr/local/arpwatch|/var/lib/%{name}|g' *.8.in *.sh.in *.sh
diff --git a/arpwatch-filter.patch b/arpwatch-filter.patch
new file mode 100644
index 0000000..a431e71
--- /dev/null
+++ b/arpwatch-filter.patch
@@ -0,0 +1,85 @@
+Add -B to specify an additional pcap filter expression, for ignoring hosts
+that are known to be noisy.
+
+PLD carried this as -F from the Debian patchset (Debian #600886) until 3.9,
+where upstream took -F for the foreground flag.
+
+--- arpwatch-3.9.orig/arpwatch.c	2026-08-16 20:52:08.675872764 +0200
++++ arpwatch-3.9/arpwatch.c	2026-08-16 20:52:08.769468541 +0200
+@@ -203,6 +203,7 @@
+ 	char *interface, *rfilename;
+ 	struct bpf_program code;
+ 	char errbuf[PCAP_ERRBUF_SIZE];
++	char *filter, *filter_user, filterbuf[1024];
+ 	char* serveruser = NULL;
+ 
+ 	if (argv[0] == NULL)
+@@ -220,10 +221,15 @@
+ 	opterr = 0;
+ 	interface = NULL;
+ 	rfilename = NULL;
++	filter_user = NULL;
+ 	pd = NULL;
+-	while ((op = getopt(argc, argv, "CdD:Ff:i:n:NpP:qr:svw:W:x:zZu:")) != EOF)
++	while ((op = getopt(argc, argv, "B:CdD:Ff:i:n:NpP:qr:svw:W:x:zZu:")) != EOF)
+ 		switch (op) {
+ 
++		case 'B':
++			filter_user = optarg;
++			break;
++
+ 		case 'C':
+ 			zeropad = 0;
+ 			break;
+@@ -434,7 +440,16 @@
+ 	}
+ 
+ 	/* Compile and install filter */
+-	if (pcap_compile(pd, &code, "arp or rarp", 1, netmask) < 0) {
++	filter = "arp or rarp";
++	if (filter_user != NULL) {
++		if (snprintf(filterbuf, sizeof(filterbuf),
++		    "(arp or rarp) and (%s)", filter_user) >= (int)sizeof(filterbuf)) {
++			lg(LOG_ERR, "filter too long");
++			exit(1);
++		}
++		filter = filterbuf;
++	}
++	if (pcap_compile(pd, &code, filter, 1, netmask) < 0) {
+ 		lg(LOG_ERR, "pcap_compile: %s", pcap_geterr(pd));
+ 		exit(1);
+ 	}
+@@ -980,7 +995,7 @@
+ {
+ 	(void)fprintf(stderr, "Version %s\n", version);
+ 	(void)fprintf(stderr,
+-	    "usage: %s [-CdFNpqsvzZ] [-D arpdir] [-f datafile]"
++	    "usage: %s [-CdFNpqsvzZ] [-B filter] [-D arpdir] [-f datafile]"
+ 	    " [-i interface]\n\t"
+ 	    " [-P pidfile] [-w watcher at email] [-W watchee at email]\n\t"
+ 	    " [-n net[/width]] [-x net[/width]] [-r file] [-u username]\n",
+--- arpwatch-3.9.orig/arpwatch.8.in	2026-08-16 20:52:08.667398559 +0200
++++ arpwatch-3.9/arpwatch.8.in	2026-08-16 20:52:08.772816820 +0200
+@@ -34,6 +34,7 @@
+ .Sh SYNOPSIS
+ .Nm
+ .Op Fl CdFNpqsvzZ
++.Op Fl B Ar filter
+ .Op Fl D Ar arpdir
+ .Op Fl f Ar datafile
+ .Op Fl i Ar interface
+@@ -63,6 +64,14 @@
+ pair.
+ .Pp
+ The
++.Fl B
++flag specifies an additional
++.Xr pcap-filter 7
++expression to narrow what is captured; the effective filter becomes
++.Dq (arp or rarp) and ( Ns Ar filter Ns Dq ) .
++This is useful to ignore hosts that are known to be noisy.
++.Pp
++The
+ .Fl C
+ flag at MANCFLAG@ uses compact padded ethernet addresses in
+ .Ar arp.dat ,
diff --git a/arpwatch.sysconfig b/arpwatch.sysconfig
index ca6d97d..b25d39a 100644
--- a/arpwatch.sysconfig
+++ b/arpwatch.sysconfig
@@ -5,7 +5,9 @@ SERVICE_RUN_NICE_LEVEL="+5"
 # this and builds its own option list from the settings below.
 ARPWATCH_OPTS=""
 
-#GLOBAL_OPTIONS=""
+# Extra arpwatch options. -B takes a pcap-filter(7) expression to ignore noisy
+# hosts; it was spelled -F before 3.9, where upstream took -F for something else.
+#GLOBAL_OPTIONS="-B 'not host 192.168.1.1 and not ether host 00:11:22:33:44:55'"
 
 # Name of monitored interfaces
 INTERFACES=
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/arpwatch.git/commitdiff/3c0ea22dfba0a791aeee172ce27dc6a36ea3d9b1