arpwatch is a computer software tool for monitoring Address Resolution Protocol traffic on a computer network.
[1] It generates a log of observed pairing of IP addresses with MAC addresses along with a timestamp when the pairing appeared on the network.
It also has the option of sending an email to an administrator when a pairing changes or is added.
Network administrators monitor ARP activity to detect ARP spoofing, network flip-flops, changed and new stations and address reuse.
arpwatch was developed by Lawrence Berkeley National Laboratory, Network Research Group, as open-source software and is released under the BSD license.