addrwatch

A tool for IPv4/IPv6 and Ethernet address pairing monitoring

This is a tool similar to arpwatch. It main purpose is to monitor network and log discovered Ethernet to IPv4/IPv6 address pairings. It supports monitoring multiple network interfaces, monitoring of VLAN tagged (802.1Q) packets, and can output to stdout, plain text file, syslog, sqlite3 and MySQL. Addrwatch tracks IPv6 addresses of hosts using IPv6 privacy extensions (RFC4941). The main difference between arpwatch and addrwatch is the format of output files. While arpwatch stores only current state of the pairings and allows to send email notification when a pairing change occurs, addrwatch do not keep persistent network pairings' state, but instead logs all the events that allow pairing discovery.