Monitor ARP activity on the network
The arpwatch command is used to monitor ARP activity on the network.
arpwatch (options)
-d: Enable debug mode.
-f <record_file>: Set the file to store ARP records, default is /var/arpwatch/arp.dat.
-i <interface>: Specify the interface to monitor ARP activity, default is eth0.
-r <record_file>: Read ARP records from a specified file instead of monitoring from the network.