exec, sending along details?

[sourcequench]

Could you provide an example of how to pass along details of the from the discovery to the exec command? I am trying to send along details of a discovery to pushbullet - but I don't know how I might get the IP/MAC into the exec. Also - I know that the .dat file has the OUI lookup manufacturer, but arpwitch output does not provide that (unless I am just using it to query the dat). Ideally I'd like to send along ip/mac/manufacturer to pushbullet.

$ arpwitch --datafile /tmp/arpwitch.dat --exec "pushbullet push note --body arpwitch"

[ndejong]

Yep - the documentation could provide more examples and clear details here

If you take a look at the cli help you'll find this hidden in that wall of text

ARP event command execution arguments:
  The following exec command substitutions are available: {IP}=ipv4-address, 
  {HW}=hardware-address, {TS}=timestamp-utc, {ts}=timestamp-utc-short

I don't know pushbullet, but I'm guessing you'll get something closer to what I think you're looking to achieve like this

arpwitch --datafile /tmp/arpwitch.dat --exec "pushbullet push note --body arpwitch:{TS}:{IP}:{HW}"

... and you ought to put quotes around that as well I'd reckon.

The point about not being able to access the OUI device manufacturer - this is a sensible feature request

[sourcequench]

Worked great. Thanks!