Linux arpwatch Command

The Linux arpwatch command is used to monitor ARP records on the network.

ARP (Address Resolution Protocol) is a protocol used to resolve IP addresses to network device hardware addresses.

arpwatch listens for ARP packets on a local network and records them, reporting any changes via E-mail.

arpwatch [-d][-f&lt;log file>][-i<interface>][-r&lt;log file>]

Parameters:

-d Enable debug mode.
-f<log file> Set the file to store ARP records, default is /var/arpwatch/arp.dat.
-i<interface> Specify the interface to monitor ARP on, default is eth0.
-r<log file> Read ARP records from the specified file instead of listening on the network.
-n Specify additional local networks.
-u Specify user and user group.
-e Send email to the specified user, not the default root user.
-s Specify a username as the return address, instead of the default user root.

Monitor ARP information on network interface eth0

arpwatch -i eth0

Monitor ARP information and log the details to a specific file

# arpwatch -i eth0 -f a.log // Log information to a.log