monitor ARP changes in ethernet networks

 The arpalert daemon is a security tool that listens on a network interface
 (without using 'promiscuous' mode) and catches all conversations
 of MAC address to IP request to alert of possibility of ARP spoofing attack.
 .
 It compares the mac addresses it detected with a pre-configured list of
 authorized MAC addresses. If the MAC is not in list, arpalert launches a
 pre-defined user script with the MAC address and IP address as parameters.
 .
 If you need to use a list of authorized MAC addresses, this package should
 suit your needs, otherwise arpwatch may be also fine.