Package: arpalert (2.0.11-2)

Monitor ARP changes in ethernet networks

This package provides the arpalert daemon.

It listens on a network interface (without using 'promiscuous' mode) and catches all conversations of MAC address to IP request. It then compares the mac addresses it detected with a pre-configured list of authorized MAC addresses. If the MAC is not in list, arpalert launches a pre-defined user script with the MAC address and IP address as parameters. This software can run in daemon mode; it's very fast (low CPU and memory consumption). It responds at signal SIGHUP (configuration reload) and at signals SIGTERM, SIGINT, SIGQUIT and SIGABRT (arpalert stops itself).

If you need to use a list of authorized MAC addresses, this package should suit your needs, otherwise arpwatch may be also fine.

Tags: System Administration: Monitoring, User Interface: Daemon, Network Protocol: Ethernet, Role: Program, Scope: Utility