arpsnmp ‐ keep track of ethernet/ip address pairings

arpsnmp [ ‐d ] [ ‐f datafile ] [ ‐m email ] file [ ...  ]

Arpsnmp keeps track for ethernet/ip address pairings. It
syslogs activity and reports certain changes via email.
Arpsnmp reads information from a file (usually generated by

The ‐d flag is used enable debugging. This also inhibits
mailing the reports.  Instead, they are sent to

The ‐f flag is used to set the ethernet/ip address database
filename.  The default is

The ‐m flag specifies the address that will receive the
emails.  The default is

Note that an empty arp.dat file must be created before the
first time you run

(See the man page for details on the report messages
generated by

/usr/operator/arpwatch ‐ default directory
arp.dat ‐ ethernet/ip address database
ethercodes.dat ‐ vendor ethernet block list

Craig Leres of the Lawrence Berkeley National Laboratory
Network Research Group, University of California, Berkeley,

The current version is available via anonymous ftp:

Please send bug reports to

Attempts are made to suppress DECnet flip flops but they
aren’t always successful.