arpwatch – The Ethernet Activity Monitor You Should Know About

Table of Contents#

Introduction
What is ARP?
Understanding arpwatch
Installation and Setup
Configuration and Usage
Practical Examples
Best Practices
Advanced Features
Troubleshooting
Conclusion
References

What is ARP?#

Before diving into arpwatch, let's briefly understand ARP. The Address Resolution Protocol is used to map IP addresses to MAC addresses on local networks. When a device wants to communicate with another device on the same network segment, it uses ARP to discover the target's physical address.

ARP Process:

Host A wants to send data to Host B (IP: 192.168.1.10)
Host A broadcasts: "Who has 192.168.1.10? Tell 192.168.1.5"
Host B responds: "192.168.1.10 is at MAC address 00:1a:2b:3c:4d:5e"
Host A caches this mapping for future use

This fundamental protocol is exploited by various network attacks, making monitoring essential.

Understanding arpwatch#

arpwatch is a network monitoring tool that listens for ARP packets on a network interface and logs various events. It maintains a database of IP-to-MAC address mappings and alerts administrators when:

New MAC addresses appear on the network
IP addresses change their associated MAC addresses
Existing mappings reappear after being absent

Key Features:#

Passive monitoring - Doesn't generate network traffic
Email alerts for significant events
Database persistence across reboots
Flexible interface binding
IPv4 monitoring focus
Actively maintained - Latest version 3.9 released in 2025

Installation and Setup#

Installation on Debian/Ubuntu#

sudo apt update
sudo apt install arpwatch

Installation on CentOS/RHEL#

sudo yum install arpwatch
# Or for newer versions:
sudo dnf install arpwatch

Installation from Source#

# Download from official repository (arpwatch 3.9 as of 2025)
wget https://ee.lbl.gov/downloads/arpwatch/arpwatch-3.9.tar.gz
tar -xzf arpwatch-3.9.tar.gz
cd arpwatch-3.9
./configure
make
sudo make install

Service Management#

# Start arpwatch service
sudo systemctl start arpwatch
 
# Enable automatic startup
sudo systemctl enable arpwatch
 
# Check status
sudo systemctl status arpwatch
 
# View logs
sudo journalctl -u arpwatch -f

Configuration and Usage#

Basic Command Line Usage#

# Monitor specific interface
sudo arpwatch -i eth0
 
# Specify data file location
sudo arpwatch -i eth0 -f /var/lib/arpwatch/eth0.dat
 
# Daemon mode with email alerts
sudo arpwatch -i eth0 -d -s [email protected]
 
# Monitor all ARP traffic on interface
sudo arpwatch -i eth0

Configuration Files#

/etc/default/arpwatch (Debian/Ubuntu):

# Interface to monitor
INTERFACES="eth0"
 
# Additional options
OPTIONS="-f /var/lib/arpwatch/arp.dat"

/etc/sysconfig/arpwatch (RHEL/CentOS):

# Command line options
ARGS="-i eth0 -f /var/lib/arpwatch/arp.dat"

Email Configuration#

Configure your MTA (Postfix, Sendmail, etc.) to ensure email alerts work:

Example postfix configuration:

sudo apt install postfix
sudo systemctl enable postfix

Practical Examples#

Example 1: Basic Network Monitoring#

# Start monitoring on eth0 interface
sudo arpwatch -i eth0 -d -f /var/lib/arpwatch/eth0.dat
 
# Check the database file
sudo cat /var/lib/arpwatch/eth0.dat

Sample output:

192.168.1.1 00:11:22:33:44:55 2024-01-15 10:30:25
192.168.1.10 aa:bb:cc:dd:ee:ff 2024-01-15 10:31:10

Example 2: Basic Daemon Mode#

# Run arpwatch in daemon mode with email alerts
sudo arpwatch -i eth0 -d -s [email protected]

Example 3: Integration with Log Analysis#

# Monitor arpwatch logs in real-time
sudo tail -f /var/log/syslog | grep arpwatch
 
# Create a custom log parser script
#!/bin/bash
tail -f /var/log/syslog | while read line; do
    if echo "$line" | grep -q "arpwatch"; then
        echo "[$(date)] ARP Event: $line" >> /var/log/arp-monitor.log
        # Add custom alert logic here
    fi
done

Example 4: Detecting ARP Spoofing#

# Script to detect MAC address changes
#!/bin/bash
LOG_FILE="/var/log/arpwatch/alerts.log"
DAT_FILE="/var/lib/arpwatch/eth0.dat"
 
check_mac_changes() {
    while read -r event; do
        if echo "$event" | grep -q "changed ethernet address"; then
            echo "ALERT: MAC address change detected - $event" >> "$LOG_FILE"
            # Send immediate notification
            echo "ARP Spoofing Alert: $event" | mail -s "ARP Security Alert" [email protected]
        fi
    done
}
 
journalctl -u arpwatch -f | check_mac_changes

Best Practices#

1. Strategic Placement#

Monitor critical network segments (DMZ, server VLANs)
Place on network taps or SPAN ports for complete visibility
Avoid monitoring wireless interfaces exclusively (use wired uplinks)

2. Alert Configuration#

# Configure meaningful email alerts
sudo arpwatch -i eth0 -d -s "[email protected],[email protected]"
 
# Set up proper email templates
# Custom script for formatted alerts
#!/bin/bash
echo "Subject: ARP Watch Alert - $(hostname)
From: arpwatch@$(hostname)
To: [email protected]
 
ARP Event Detected:
- Time: $(date)
- Interface: $1
- Event: $2
- IP: $3
- MAC: $4
 
Please investigate promptly." | sendmail -t

3. Database Management#

# Regular database backup
#!/bin/bash
DATE=$(date +%Y%m%d)
cp /var/lib/arpwatch/eth0.dat /backup/arpwatch/eth0.dat.$DATE
gzip /backup/arpwatch/eth0.dat.$DATE
 
# Cleanup old backups (keep 30 days)
find /backup/arpwatch -name "eth0.dat.*" -mtime +30 -delete

4. Integration with SIEM#

# Forward arpwatch events to SIEM via syslog
# Add to /etc/rsyslog.conf
:programname, isequal, "arpwatch" @siem-server:514
 
# Custom log format for better parsing
template(name="ARPWatchFormat" type="string" 
         string="%timereported% %hostname% arpwatch[%procid%]: %msg%")

5. Performance Considerations#

Avoid monitoring high-traffic interfaces without filtering
Use appropriate network hardware for monitoring ports
Consider resource limitations on virtual machines

Advanced Features#

IPv6 Monitoring with addrwatch#

arpwatch focuses on IPv4 ARP monitoring. For IPv6 neighbor discovery monitoring, use addrwatch, a modern tool that monitors both IPv4 and IPv6 address pairings:

# Install addrwatch (available in many distribution repositories)
sudo apt install addrwatch  # Debian/Ubuntu
 
# Monitor both IPv4 and IPv6 on an interface
sudo addrwatch eth0
 
# Run in daemon mode
sudo addrwatch -d eth0

addrwatch logs IPv6 Neighbor Discovery events (ND_NS, ND_NA, ND_DAD) alongside ARP events, making it ideal for networks with IPv6 autoconfiguration enabled.

Custom Scripting Integration#

#!/bin/bash
# Advanced monitoring script with threat intelligence
THREAT_API="https://api.threatintel.com/mac/"
 
check_mac_reputation() {
    local mac=$1
    local response=$(curl -s "$THREAT_API$mac")
    if echo "$response" | grep -q "malicious"; then
        echo "CRITICAL: Known malicious MAC address detected: $mac"
        # Trigger incident response
    fi
}
 
# Parse arpwatch events
journalctl -u arpwatch -f --since "1 hour ago" | while read line; do
    if echo "$line" | grep -q "new station"; then
        mac=$(echo "$line" | grep -oE '([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}')
        check_mac_reputation "$mac"
    fi
done

Database Analysis Tools#

# Script to analyze arpwatch database
#!/bin/bash
DAT_FILE="${1:-/var/lib/arpwatch/eth0.dat}"
 
echo "ARP Watch Database Analysis"
echo "============================"
echo "Total entries: $(wc -l < "$DAT_FILE")"
echo
echo "Recent activity (last 10 entries):"
tail -10 "$DAT_FILE" | while read ip mac timestamp; do
    echo "- $ip -> $mac ($timestamp)"
done
echo
echo "Duplicate IP addresses:"
awk '{print $1}' "$DAT_FILE" | sort | uniq -d

Troubleshooting#

Common Issues and Solutions#

1. arpwatch not starting:

# Check interface existence
ip link show
 
# Verify permissions
sudo -u arpwatch arpwatch -i eth0
 
# Check for process conflicts
ps aux | grep arpwatch

2. No email alerts:

# Test email system
echo "Test" | mail -s "Test" [email protected]
 
# Check arpwatch email configuration
sudo arpwatch -i eth0 -s [email protected]

3. Database corruption:

# Backup and recreate database
sudo cp /var/lib/arpwatch/eth0.dat /var/lib/arpwatch/eth0.dat.backup
sudo rm /var/lib/arpwatch/eth0.dat
sudo systemctl restart arpwatch

4. High resource usage:

# Monitor arpwatch resource consumption
top -p $(pgrep arpwatch)
 
# Monitor specific interface only
sudo arpwatch -i eth0

Debug Mode#

# Run in foreground with debug output
sudo arpwatch -i eth0 -d -f /var/lib/arpwatch/eth0.dat -r
 
# Check system logs
sudo tail -f /var/log/syslog | grep arpwatch

Conclusion#

arpwatch remains a valuable tool in the network security arsenal, despite being a decades-old utility. Its passive monitoring approach, simplicity, and effectiveness in detecting network anomalies make it particularly useful for:

Security teams detecting ARP spoofing and MITM attacks
Network administrators monitoring device connectivity
Incident responders investigating network intrusions
Compliance auditors verifying network integrity

While modern networks have evolved, the fundamental protocols like ARP haven't changed, making arpwatch as relevant today as it was when first developed. By implementing arpwatch with the best practices outlined in this guide, you can significantly enhance your network visibility and security posture.

Remember that arpwatch is just one layer in a comprehensive security strategy. Combine it with other monitoring tools, intrusion detection systems, and security policies for robust network protection.

References#

Official Documentation#

arp-scan - Active ARP discovery tool
arpon - ARP defense tool
addrwatch - Modern arpwatch alternative with IPv4/IPv6 support (GitHub)
arpwitch - Modern arpwatch replacement with JSON output (GitHub)
XArp - GUI-based ARP monitoring

Security Standards#

Community Resources#

This blog post is intended for educational purposes. Always test tools in controlled environments before deploying in production networks.