arpwatch (ARP Monitor)

Networking 2026-08-28

arpwatch monitors Ethernet ARP traffic and maintains a database of IP-to-MAC address mappings. It sends an email alert (via the local MTA) when a new device appears on the network, when a known device changes its MAC address, or when an IP address flips between two MAC addresses — all indicators of network changes that may warrant attention (new devices, DHCP lease changes, or potential ARP spoofing).

arpwatch is pre-installed on Shani OS. Not active by default.

Enable

# Enable monitoring on your primary LAN interface (replace eth0 with yours)
sudo systemctl enable --now arpwatch@eth0

# If you have multiple interfaces
sudo systemctl enable --now arpwatch@wlan0

# Check status
systemctl status arpwatch@eth0

# Watch logs
journalctl -u arpwatch@eth0 -f

Configuration

Default behaviour is to send email reports to root. Forward root's mail to a real address via /etc/aliases (see the Exim page).

The ARP database for each interface is stored at /var/lib/arpwatch/<interface>.dat.

Customise Per-Interface Options

Create a drop-in override for the interface unit:

sudo systemctl edit arpwatch@eth0

Add options via ARPWATCH_ARGS:

[Service]
Environment=ARPWATCH_ARGS="-m admin@example.com -n 192.168.1.0/24"

Common flags:

Flag	Effect
`-m address`	Send reports to this email address instead of root
`-n network/prefix`	Only watch this subnet (ignore others)
`-N`	Disable email entirely (log-only mode)
`-p`	Disable promiscuous mode (only watch traffic to/from this machine)
`-u user`	Drop privileges to this user after starting

Database Management

# View the current IP→MAC database
sudo cat /var/lib/arpwatch/eth0.dat

# Format: MAC  IP  timestamp  hostname
# Example:
# aa:bb:cc:dd:ee:ff  192.168.1.50  1713600000  desktop.home.local

# Clear the database (triggers "new activity" alerts for all devices on next run)
sudo truncate -s 0 /var/lib/arpwatch/eth0.dat
sudo systemctl restart arpwatch@eth0

Log Events

arpwatch logs to syslog and via the systemd journal. Event types:

Event	Meaning
`new activity`	First time this IP+MAC pair is seen
`new station`	New MAC address never seen before
`changed ethernet address`	A known IP now has a different MAC — possible ARP spoof or DHCP change
`flip flop`	An IP is alternating between two MACs
`reused old ethernet address`	A MAC that was previously associated with a different IP is back

# See all arpwatch events
journalctl -u arpwatch@eth0 --no-pager | grep -E "new|changed|flip"

Troubleshooting

Issue	Solution
No events appearing	Confirm the correct interface name — run `ip link` to list interfaces; arpwatch only processes traffic it can see
Email alerts not arriving	Ensure Exim (or another MTA) is running and root's mail is forwarded — see the Exim page
Too many "new activity" alerts on first run	Normal — arpwatch builds its database from scratch; alerts settle after all known devices have been seen once
`changed ethernet address` for a trusted device	Mobile devices use MAC randomisation by default — disable randomisation for that device on your router/AP, or accept the alerts