Re: [tlug] pcap

[Chris Crowther <chrisc@example.com>]

On Sun, 14 Apr 2002, Tony Laszlo wrote:

> being installed/upgraded was arpwatch.
> Could this be part of that process,
> or something more sinister?

	The group and user name would suggest it's an account for packet
capture to run under, which would make sense for something which is
watching ARP packets...one of the easiest ways to monitor any type of
network traffic is just to create a BPF filter and look at the packets it
grabs.

	Do RH list what packages will add/remove from your system anyway?
Seems like the kind of information it would be handy to provide.

-- 
Chris "_Shad0w_" Crowther
chrisc@example.com
http://www.shad0w.org.uk/