#!/bin/sh
# $Id: arp2ethers,v 1.1 2003/09/07 04:57:02 elkner Exp $
#
# Convert arp.dat to ethers format
#
#   - sort on timestamp, newest first
#   - discard entries without simple hostnames
#   - discard all but first occurance of each ethernet address
#   - discard entires with raw ip addresses for simple names
#   - remove ip address and timestamp fields
#   - append "-ip" to hosts with decnet address too
#   - append "-old", "-old1", etc. as necessary
#   - sort

Usage() {
cat<<EOF
  Convert an arpwatch arp.dat file to ethers(5) format
 
  Usage: $0 file

    file .. an arpwatch arp.dat file (usually /var/arpwatch/arp.dat)
EOF
}

if [ -z "$1" -o ! -r "$1" ]; then
	Usage
	exit 1
fi

sort +2rn $1 | \
	awk 'NF == 4 { print }' | \
	awk '{
		# Only print the first ethernet address seen (p.awk)
		e = $1
		if (seen[e])
			next
		seen[e] = 1
		print
	}' | \
	egrep -v '\.[0-9][0-9]*$' | \
	sed -e 's/	.*	/	/' | \
	awk '
		# DECnet hacking (d.awk)
		BEGIN {
			n = 0
			sdecnet = "aa:0:4:"
			ldecnet = length(sdecnet)
		}

		{
			++n
			e[n] = $1
			h[n] = $2
			if (sdecnet == substr($1, 1, ldecnet))
				decnet[$2] = 1
		}

		END {
			for (i = 1; i <= n; ++i) {
				if (decnet[h[i]] && sdecnet != substr(e[i], 1, ldecnet))
					h[i] = h[i] "-ip"
				print e[i] "\t" h[i]
		}
	}' | \
	awk '{
		# Add -old suffix to sorted ethers file, as required. (e.awk)
		if (!seen[$2]) {
			seen[$2] = 1
			print
			next
		}
		h = $2 "-old"
		s = h
		for (n = 1; seen[h]; ++n)
			h = s n
		seen[h] = 1
		print $1 "\t" h
		next
	}' | \
	sort