[PLUG] Unknown user?

[Mike Russell]

It is the arpwatch demean, if you install arpwatch, it will use this user 
to send you arp info. my earlier post about "two ethn in one box error" was 
concerning this. I later found that my problem was on how I had my network 
wired up to the new router, I received email's every two minuets from 
pcap at mydomain.com until I fixed the issue.
example;
arpwatch: flip 
flop     the.ip.add.ress         the:mac:add:ress:xx 
(the:mac:add:ress:switch:from)

the issue was, I received an error that some other host had my IP address 
when I init'ed my eth0. then i would receive an arpwatch email from my 
other server telling me that the MAC address has changed for the IP 
address. I don't have enough TCP/IP knowledge to explain, but it happened 
when i had both sides of the router plugged into the same HUB with 
different IP blocks ( 10.10..1.x/24 and 209.162.208.x/24). I believe it had 
something to do with having the same subnet-mask. I thought they would 
ignore each other, my bad.

I hope I answered your question, and would appreciate any explanation of my 
TCP/IP issue.

mike

At 06:34 AM 8/7/2002, you wrote:
>   I get warnings in my postfix daily report of a difference between
>/etc/passwd and /var/spool/postfix/etc/passwe. Turns out that the former has
>this user entry:
>
>pcap:x:77:77::/var/arpwatch:/sbin/nologin
>
>and the latter doesn't.
>
>   I did not add this "user" myself so I'm curious why it's there and what
>program installed it.
>
>   Anyone know?
>
>Thanks,
>
>Rich
>
>
>_______________________________________________
>PLUG mailing list
>PLUG at lists.pdxlinux.org
>http://lists.pdxlinux.org/mailman/listinfo/plug