Binary package “arpalert” in ubuntu precise
monitor ARP changes in ethernet networks
The arpalert daemon listens on a network interface (without using
'promiscuous' mode) and catches all conversations of MAC address to IP
request.
It then compares the mac addresses it detected with a pre-configured list of
authorized MAC addresses. If the MAC is not in list, arpalert launches a
pre-defined user script with the MAC address and IP address as parameters.
.
If you need to use a list of authorized MAC addresses, this package should
suit your needs, otherwise arpwatch may be also fine.