In this tutorial I will show you, how to Monitor Ethernet Activity in Linux using Arpwatch.
How To Monitor Ethernet Activity In Linux?
Let us take a look of how to monitor the ethernet activity using arpwatch on Linux.
Before you can use the arpwatch tool, you will need to first install it as it typically will not come with your Linux distro.
On Debian, Ubuntu and other distros based on them such as Linux Mint, arpwatch tool can be installed by using the apt-get command.
Install arpwatch In Debian/Ubuntu Based Distros
On RHEL and related distros such as CentOS, arpwatch can be installed using the yum command.
/etc/rc.d/init.d/arpwatch – Arpwatch service to start or stop daemon
/etc/sysconfig/arpwatch – This is the main configuration file
/usr/sbin/arpwatch – Binary command to start and stop tool using the terminal
/var/log/messages – It is the system log file where arpwatch writes any changes or unusual activity to IP/MAC
Open /etc/sysconfig/arpwatch and edit the file with this
eth0 -a -n 192.168.1.0/24 -m email@example.com
Or via terminal with
OPTIONS=” -u arpwatch -e firstname.lastname@example.org -s ‘root (Arpwatch)'”
The email notification will be sent to the specified email id with log details.
Type the following command to start the arpwatch service –
Anytime there is a new MAC is plugged or a particular IP is changing its MAC address on the ethernet network, you will notice syslog entries at either ‘/var/log/syslog‘ or ‘/var/log/message‘ file.
Here’s a quick list of the report messages generated by arpwatch
new activity – This ethernet/ip address pair has been used for the first time six months or more.
new station – The ethernet address has not been seen before.
flip flop – The ethernet address has changed from the most recently seen address to the second most recently seen address. If either the old or new ethernet address is a DECnet address and it is less than 24 hours, the email version of the report is suppressed.
changed ethernet address – The host switched to a new ethernet address.
For more information enter ‘man arpwatch’ via the terminal.
Hope you find this tutorial useful. Share your thoughts with us in the comments below.