ECHOLOT(1)

NAME
echolot - network station monitor

SYNOPSIS
echolot [-a|-n|-o] [-i interface] [-d database] [-D description|-N|-X external.pl] [-h|-v]

DESCRIPTION
If you're running the ip protocol over ethernet, what I assume you to do, your ip stack will map ip addresses to mac addresses. This macs are world wide unique and this enables you to find known hosts on foreign networks (eg you are travelling to lan parties and want to find your favourite ftp). You can also detect new hosts in your companies lan (that might be intruders). The underlaying Address Resolution Protocol is described in RFC 826, an internet standard. Arp uses broadcasts to determine those mac addresses, that are delivered to all hosts on a lan (unless you are using a gateway; traceroute is your friend;-) So echolot is listening on a network interface, grabs arp packets and stores them in a database. If you are running in "-o" mode, it'll find known hosts (popular hosts) on your local network by their signature and announce this to console. If you are running in "-n" mode, it'll find new hosts (possible intruders) on your local network by their signature and announce this to console.

OPTIONS

-a, --all
    announce all hosts, this is default

-n, --new
    announce new hosts

-o, --old
    announce known hosts

-i, --interface
    use given interface, default is "any"

-d, --database
    use given database, default is "default.mac"

-D, --description
    set identity for new hosts

-N, --nameserver
    ask nameserver for identity

-X, --external
    use external script for identity, "echolot -X scripts/date.pl"

-h, --help
    print this short help

-v, --version
    print release information

EXAMPLE
echolot -N
    // use default.mac, print all information, use dns as identity echolot -n -i eth1 -d hosts.mac -D "my network"
    // use hosts.mac, print only new hosts, use "my network" as identity echolot -i eth0 -d lanparty.mac -X scripts/date.pl
    // use lanparty.mac, print all information, use interface eth0, use "date.pl" as identity

SEE ALSO
tcpdump(1), libpcap(3), echolot source

COPYRIGHT
echolot may be used under the terms of the BSD License.

TO DO
The database format is compatible with iptraf, but I didn't check out the limits (of both), yet. echolot takes the mac address from the arp header. This headers can be faked. Using the ethernet header (and fetching all ethernet packets) would be better. The size if the database is limited in the source code. You could rewrite this part, using binary trees or hash tables. The length of host descriptions is also limited in 'database.h'. I've set it to 255 chars. The return value of "external.pl" is not checked for lfs, ffs, crs.

AUTHORS
echolot was written in 2002 by Benjamin Schweizer <besh@gmx.net>
  http://www.redsheep.de/ a lot of help with the BSD port was given by Andreas Turtschan
  <an.tu@gmx.de> the code uses the libpcap, which is (c) by the tcpdump group.
  http://www.tcpdump.org/ getopt.c as part of the glibc is (c) by the FSF
  http://www.fsf.org/ autoconf/automake are (c) by GNUs Not Unix
  http://www.gnu.org/