Linux arpwatch command

The Linux arpwatch command is used to listen to ARP records on the network.

ARP (Address Resolution Protocol) is a protocol used to resolve IP and network device hardware addresses.

arpwatch can listen to ARP packets in the local area network and record them, and at the same time, the changes detected through E-mail to report.

Syntax

arpwatch [-d][-f<record file>][-i<interface>][-r<record file>]

Parameters:

-d Start debugging mode.
-f<record file> Set the file to store ARP records, the default is/var/arpwatch/arp.dat.
-i<interface> Specify the interface to listen to ARP, the default interface is eth0.
-r<record file> Read ARP records from the specified file instead of listening on the network.
-n Specify the additional local network
-u Specify the user and group
-e Send email to the specified user instead of the default root user
-s Specify the username as the return address instead of the default user root

Listen to the ARP information of the network interface eth0

arpwatch -i eth0

Listen to ARP information and log relevant information into the corresponding file

# arpwatch -i eth0 -f a.log //Log information into a.log