From 31b5c0bb422ef1ffcc5ec568dac5a00fd51d042e Mon Sep 17 00:00:00 2001
From: mboelen <michael@cisofy.com>
Date: Tue, 29 Dec 2015 16:28:18 +0100
Subject: [PATCH] Merged changes for ARPwatch

---
 include/tests_networking | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/include/tests_networking b/include/tests_networking
index fc5535c7..b4b640af 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -22,6 +22,7 @@
     LOCAL_DNSRESOLVER_FOUND=0                       # Local DNS resolver
     NUMBERACTIVENS=0                                # Number of active nameservers
     DHCP_CLIENT_RUNNING=0                           # DHCP client availability
+    ARPWATCH_RUNNING=0                              # ARP-cache based attack monitoring software
 #
 #################################################################################
 #
@@ -491,6 +492,22 @@
     fi
 #
 #################################################################################
+#
+    # Test        : NETW-3032
+    # Description : Checking for ARP-Spoofing monitoring software
+    Register --test-no NETW-3032 --os Linux --weight L --network NO --description "Checking for ARP-Spoofing monitoring software"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        IsRunning arpwatch
+        if [ ${RUNNING} -eq 1 ]; then
+            ARPWATCH_RUNNING=1
+            Display --indent 2 --text "Checking for ARP-Spoofing monitoring software" --result RUNNING --color GREEN
+          else
+            Display --indent 2 --text "Checking for ARP-Spoofing monitoring software" --result "NOT FOUND" --color RED
+            ReportSuggestion ${TEST_NO} "Install ARP-Spoofing attack monitoring software like 'arpwatch'"
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : NETW-3030
     # Description : Checking for DHCP client
@@ -508,7 +525,9 @@
 #################################################################################
 #
 
-Report "dhcp_client_running=${DHCP_CLIENT_RUNNING}"
+report "dhcp_client_running=${DHCP_CLIENT_RUNNING}"
+report "arpwatch_running=${ARPWATCH_RUNNING}"
+
 wait_for_keypress
 
 #