[1][2] NDPMon observes the local network for anomalies in the function of nodes using Neighbor Discovery Protocol (NDP) messages, especially during the Stateless Address Autoconfiguration.
[3] When an NDP message is flagged, it notifies the administrator by writing to the syslog or by sending an email report.
For IPv6, NDPMon is an equivalent of Arpwatch for IPv4, and has similar basic features with added attacks detection.
It permits tracking the usage of cryptographically generated interface identifiers or temporary global addresses when Privacy extensions are enabled.
NDPMon is free software published under the GNU Lesser General Public License version 2.1.