Linux arpwatch command

The Linux arpwatch command is used to listen to ARP records on the network.

ARP (Address Resolution Protocol) is a protocol used to resolve IP and network device hardware addresses.

arpwatch can listen to ARP packets in the local area network and record them, and at the same time, the changes observed through E-mail to report.

Syntax

arpwatch [-d][-f<record file>][-i<interface>][-r<record file>]

Parameters:

-d Start debug mode.
-f<record file> Set the file to store ARP records, the default is/var/arpwatch/arp.dat.
-i<interface> Specify the interface to listen to ARP, the default interface is eth0.
-r<record file> Read ARP records from the specified file instead of listening on the network.
-n Specify the additional local network
-u Specify the user and group
-e Send email to the specified user instead of the default root user
-s Specify the username as the return address instead of the default user root

Listen to the ARP information of network interface eth0

arpwatch -i eth0

Listen to ARP information and record relevant information to the corresponding file

# arpwatch -i eth0 -f a.log //Record information to a.log