	Version 1.1a (NETWATCH)

	NETWATCH is VERY loosely based on the code from Statnet...
	thanks out to Jeroen and Scot...
	
	NETWATCH allows a user (superuser) to monitor an ETHERNET
	and examine activity on the network. Hostnames are highlighted
	in colours (for those supporting them) to indicate activity
	on the bus network based on time ( less than 1 minute RED,
	less than 5 minutes YELLOW, less than 30 minutes GREEN and
	otherwise BLUE). The monitor includes statistics on 
	a) Transmitted and received packets 
	b) Transmitted and received bytes
	c) Protocol of LAST packet (TX or RC)
	d) LAST Communication partner (IP address)
	e) Logging entire stats to ASCII file (large...)

	The number of hosts capable of support is a function of
	memory. They are stored in 2 doubly-linked lists (local
	and remote).
	
	Screen updates take place based on changes since we have
	a series of threads that allow updates dynamically.
	
	Keyboard usage is admittedly limited.
	TAB	Switches between LOCAL and REMOTE sections of screen
	<RIGHT>	Go forward to next display option
	<LEFT> 	Go backward to previous display option 
	<UP> 	Go back to previous page (back 20 lines on most consoles)
			(working on the selected REMOTE OR LOCAL section)
	<DOWN>	Go forward to next page (forward 20 lines on most consoles)
			(working on the selected REMOTE OR LOCAL section)
	c	Clear counters for fresh counting
	n	Clear linked lists for new start
	d	Toggle between allowing remote DOMAIN service hosts and not
	b	Toggle between showing the OLD (blue) hosts and not
		
	There is rudimentary logging capability, using the 'l' command.
	This saves the current statistics (all) to a file called
	"/etc/netwatch.stats". WARNING: This file may get VERY large.
	Statistics for the local machines are dumped THEN the remote
	machines. This info is APPENDED to the file.
	LOGGING is improving.. stay tuned

	RELOAD option in the config file allows the user to set
	a start time for RELOADing as well as an offset time (to
	indicate when the next RELOAD will occur). Stats are saved on
	a reload and the netwatch stats are cleared.

 
	It is a simple program to execute for ETHERNET under LINUX.
	As of version 0.6a, the program will search for information
	from the "/proc" file system. If it is not there, 
	it assumes that there is a "/etc/rc.d/rc.inet1" file for
	network configuration. If so, it checks for an "eth0" ifconfig
	and picks up the netmask from the file.
	
	For those with multiple "eth" interfaces, I am sorry it doesn't
	support both simultaneously. For "eth1" support, use the
	command line 

		netwatch -e eth1

	As of version 0.6a, this program calls home with a simple
	packet of info including the domain and machine name which
	is running. It is not used for anything except registering
	netwatch use on the Internet. It creates a file in your home
	directory called ~/.netwatch.<version>. If the file is already there,
	it does not call home. This means that it will call home only
	once for the program. It is not a true registration in the
	sense of obtaining a license (or anything like that). Info
	transmitted is very limited.

	The "ppp" interface is NOW supported (as of 0.9b).
	Simply specify

		netwatch -e ppp0

		(or whatever ppp device you desire)


	Status Line is configurable via the "s" command... which 
	cycles through the various status lines (13 in all)

	Status Line #1:  Standard Netwatch Status line
	Status Line #2:  NetBus Attack Warning
	Status Line #3:  B.O. Attack Warning
	Status Line #4:  Bad Mac Address display
	Status Line #5:  Netresolv stats -> IP address to name conversion
	Status Line #6:  Number of Hosts in List (Local and Remote)
	Status Line #7:  RELOAD status (option via config file)
	Status Line #8:  Base filename for stats logging (for reload and "l")
	Status Line #9:  Netwatch Config filename
	Status Line #10: Log filename (for "p" command)
	Status Line #11: Device/Netmask/Local IP
	Status Line #12: Mail warning destination for Netbus & B.O. attacks
	Status Line #13: Debug line... unused in release

	The multiple command works with "s"
	so
		10s  repeats the s command 10 times

	NOTE: This repeat works with normal movement commands as well
		to go down in a list quickly etc...


	The ROUTER WATCH has been extended to include a 
	character graphics router summary for the previous DAY
	(only a DAY worth stored). To obtain the graph...

	"w"	for watch mode
	"r"	for router stats
	"s"	for router stats summary (a toggle..."s" again returns
			to normal stats)

		while in summary mode... there is a time option where
		stats are summarized (default is 60 min). To cycle
		through the legitimate times use the "d" command.
		The time should be updated to 60/30/15/1 minutes...
		
		The graph indicates the router throughput average over the
		summary time. The graph is automatically scaled using the
		maximum burst throughput as the maximum for the display.

		LEFT ARROW will allow you to move to the left in the 
		graph to see previous values

		RIGHT ARROW will allow you to return to right in the
		graph.

		Arrow commands may be used with Numbers as well

		i.e.   10<LEFT> will move to the left by 10 units
		
		Units in the graph are dependent on your time option.
		One unit in the 60 min. mode is 60 min.
 
	AUTHOR:	
		G. MacKay
		E-MAIL:	mackay@uno.slctech.org
	

INSTALLATION of SOURCE based package:

	1.0	Unpack the ARCHIVE (which you have probably already done
		to read this)
		Try:

		tar -xzf netwatch-1.3.0.tgz
		cd netwatch		(move to the new directory with
						source)

	2.0	Run the shell script

		./configure

		This should generate a Makefile.....	


	3.0	Compile the program

		make netwatch		(actually "make" by itself works)

	4.0	If there are no errors, you can install the program

			make install

			(Warning... you must be root to install
			AND due to the nature of the program
			it is NO LONGER SET-UID root... you must
			have privileges to run it)

		NOTE:  INSTALL DIRECTORY is /usr/local/bin
			Edit Makefile to change for your preference.
			(copying  netwatch and netresolv to a directory in
			 your SEARCH PATH will also work)


INSTALLATION of BINARY based package:

	1.0	Unpack the ARCHIVE (which you have probably already done
		to read this)
		Try:

		tar -xzf netwatch-1.3.0.bin.tgz
		cd netwatch		(move to the new directory with
						source)

	2.0	Install the software

			make install

			(Warning... you must be root to install
			AND due to the nature of the program
			it is NO LONGER SET-UID root... you must
			have privileges to run it)

		NOTE:  INSTALL DIRECTORY is /usr/local/bin
			Edit Makefile to change for your preference.
			(copying  netwatch and netresolv to a directory in
			 your SEARCH PATH will also work)


	Good luck...

	Gord.


NOTE:   A sample configuration file is available
		"netwatch.conf.eg"

	Place this in /root/.netwatch.conf and set as you will

