.TH NDPMON 8 "November 2006"
.SH NAME
ndpmon - Neighbor Discovery Protocol Monitor
.SH SYNOPSIS
.na
.B ndpmon
[
.B -i
.I interfacename
] [
.B -f
.I configfile
] [
.B -d
.I dtd_file
] [
.B -F
.I filter
]
.br
.ti +7
[
.B -n
.I number
] [
.B -L
] [
.B -v
] [
.B -h
] [
.B -d
.I dtd_file
]
.br
.ti +7
[
.B -g
.I neighbor_file
]
.ad
.SH DESCRIPTION
.B NDPMon
is  a monitoring software for ipv6 Neighbor Discovery. It syslogs activity and reports by email malicious ND message.
.B NDPMon
uses
.BR libpcap
to listen for icmp6 packets and 
.BR libxml2
to use configuration and neighbor cache files.
.LP
The
.B -i
flag is used to change the default interface eth0.
.LP
The
.B -f
flag is used to change the path of the configuration file.
The default is
.IR /etc/ndpmon/config_ndpmon.xml
.LP
The 
.B -e
flag is used to change the path to the DTD file for the configuration file. The default is
.I /etc/ndpmon/config_ndpmon.dtd
.LP
The
.B -n
flag uses libpcap to specify a limited number of packet to capture.
.LP
The
.B -F
flag allows one to change the default icmp6 filter.
.LP
The
.B -L
flag is used to disable syslog and mail reports. This is used to do a learning phase and constitue the neighbor cache.
.LP
The
.B -v
is used to enable the DEBUG mode.
.LP
The 
.B -d
flag is used to change the path to the DTD file for the neighbor cache. The default is
.I /var/lib/ndpmon/neighbor_list.dtd
.LP
The
.B -g
flag is used to change the path to the neighbor cache. The default is 
.I /var/lib/ndpmon/neighbor_list.xml
.LP
Note that an empty
.I neighbor_cache.xml
file must be created before the first time you run
.BR ndpmon.
.LP 
.BR NDPMon
must be run with
.BR root
rights to work.
.LP
.SH "REPORT MESSAGES"
Here's the list of the report messages generated by
.BR ndpmon:
.TP
.B "wrong couple MAC/IP"
Separately, the MAC and IP addresses are valid, but not as
a couple.
.TP
.B "wrong router mac"
The ethernet address of the RA message is not specified in the 
configuration file.
.TP
.B "wrong router ip"
The ip address of the RA message is not specified in the 
configuration file.
.TP
.B "wrong prefix"
The prefix announced in the RA message is not specified in the 
configuration file.
.TP
.B "wrong router redirect"
The RD message does'nt come from a router specified in the configuration file.
.TP
.B "NA router flag"
The NA specifies a router but isn't one according to the configuration file.
.TP
.B "DAD DOS"
The NA answer to NS to avoid it to get an ip address.
.TP
.B "changed ethernet address"
The host switched to a new ethernet address.
.TP
.B "flip flop"
The ethernet address has changed from the most recently seen address to
the second most recently seen address.
.TP
.B "reused old ethernet address"
The ethernet address has changed from the most recently seen address to
the third (or greater) least recently seen address.
.SH "SYSLOG MESSAGES"
Here are some of the syslog messages;
note that messages that are reported are also sysloged.
.TP
.B "new activity"
This ethernet/ip6 address pair has been announced for last time two
months or more.
.TP
.B "new station"
The ethernet address has not been seen before on the link.
.TP
.B "ethernet broadcast"
The mac ethernet address of the host is a broadcast address.
.TP
.B "ip broadcast"
The ip address of the host is a broadcast address.
.TP
.B "bogon"
The source ip address is not local to the local subnet.
.TP
.B "ethernet mismatch"
The source mac ethernet address didn't match the address announced in
option of the ND message.
.SH FILES
.na
.nh
.nf
config_ndpmon.xml - contains settings which must be fill by the administrator
neighbor_list.xml - neighbor cache: all neighbors known to be on the link 
.ad
.hy
.fi
.SH "SEE ALSO"
.na
.nh
.BR arpwatch (8)
.BR ipv6 (7),
.BR pcap (3),
.BR libxml (3).
.ad
.hy
.SH AUTHOR
Thibault Cholez and Frederic Beck for
MADYNES Project,
Loria,
Fr.
.RE
.SH BUGS
.TP
Please send bug reports to frederic.beck@loria.fr
or thibault.cholez@esial.uhp-nancy.fr 
.LP