arpwatch
Ethernet/FDDI station activity monitor
remote-system-discoveryRed Team
Toolremote-system-discoveryredLinuxKali LinuxPlatforms: Linux · Last verified September 6, 2026
Arpwatch maintains a database of Ethernet MAC addresses seen on the network, with their associated IP pairs. Alerts the system administrator via e-mail if any change happens, such as new station/activity, flip-flops, changed and re-used old addresses.
Only use this tool against systems you own or are explicitly authorized to test — see the disclaimer.
Getting started
See the official Kali tool page and upstream homepage linked above for installation and usage details.
