Getting notified when new hosts appear on your network

I had to debug an interesting network problem a few weeks back, and wanted to see when new hosts appeared on my network. While debugging the issue, I needed to find a way to get notified when a new host appeared (I didn’t want to sit at a terminal reviewing the output from snoop and tcpdump). Enter arpwatch, which can be used to send alerts the first time a client issues an ARP request. This is actually quite handy, and the alerts you get my e-mail are rather useful:

$ arpwatch -i br0

From: root (Arpwatch)
To: root
Subject: new station

ip address:
ethernet address: 0:1c:b3:c2:80:2f
ethernet vendor:
timestamp: Friday, April 30, 2010 23:07:32 -0400

There are a slew of options to control who gets the e-mail, whether to use a saved packet capture instead of an active network connection, etc. Arpwatch is a pretty cool tool, and saved me a lot of time and hassle!

This article was posted by Matty on 2010-06-05 09:01:00 -0400 EDT