How To Monitor Ethernet Activity In Linux Using Arpwatch
On Debian, Ubuntu and other distros based on them such as Linux Mint, arpwatch tool can be installed by using the apt-get command.
new activity – This ethernet/ip address pair has been used for the first time six months or more.
new station – The ethernet address has not been seen before.
flip flop – The ethernet address has changed from the most recently seen address to the second most recently seen address. If either the old or new ethernet address is a DECnet address and it is less than 24 hours, the email version of the report is suppressed.
changed ethernet address – The host switched to a new ethernet address.
For more information enter ‘man arpwatch’ via the terminal.
Hope you find this tutorial useful. Share your thoughts with us in the comments below.