<!--

- Arpwatch decoders

- Author: Daniel Cid.

- Updated by Wazuh, Inc.

- Copyright (C) 2015-2020, Wazuh Inc.

- Copyright (C) 2009 Trend Micro Inc.

- This program is a free software; you can redistribute it and/or modify it under the terms of GPLv2.

-->

<!--

- Will extract srcip/mac for "new station" messages.

- Examples:

- arpwatch: new station 192.168.1.103 0:11:43:5e:5d:80 eth0

- arpwatch: bogon 172.16.150.149 0:2:b3:d6:e5:68 eth0

- arpwatch: new station 192.168.2.10 0:c0:4f:78:32:be

- arpwatch: pcap open re0: /dev/bpf0: Permission denied

- arpwatch: reused old ethernet address 192.168.17.248 0:e:3b:a:cb:67 (0:1e:8c:72:b0:d0)

-->

<decoder name="arpwatch">

<program_name>^arpwatch</program_name>

</decoder>

<decoder name="arpwatch-new">

<parent>arpwatch</parent>

<prematch>^new station |^bogon </prematch>

<regex offset="after_prematch">^(\S+) (\S+)</regex>

<order>srcip, extra_data</order>

<fts>name, srcip, extra_data</fts>

</decoder>