Difference between revisions of "ARPwatch"
From Notes_Wiki
| Line 119: | Line 119: | ||
== Arpwatch alerts persist across reboots == | == Arpwatch alerts persist across reboots == | ||
* | * Create a systemd service file | ||
<pre> | <pre> | ||
| Line 146: | Line 146: | ||
</pre> | </pre> | ||
Before starting the service, manually create the database files: | * Before starting the service, manually create the database files: | ||
<pre> | <pre> | ||
| Line 152: | Line 152: | ||
</pre> | </pre> | ||
Give permission to arpwatch user: | * Give permission to arpwatch user: | ||
<pre> | <pre> | ||
| Line 158: | Line 158: | ||
</pre> | </pre> | ||
Start and enable the service: | * Start and enable the service: | ||
<pre> | <pre> | ||
| Line 166: | Line 166: | ||
</pre> | </pre> | ||
After few minutes, check the database file to view the alerts | * After few minutes, check the database file to view the alerts | ||
<pre> | <pre> | ||
Revision as of 11:55, 7 October 2025
Home > Rocky Linux or CentOS > Rocky Linux 9.x > Rocky 9.x Network Monitoring Tools > ARPwatch
Create Virtual Machine
- Create a Rocky 9.x VM in the Vcenter
- Select All VLANs Trunk in Network Adapter while creating the Virtual Machine
Configure Network Scripts
Create Network Scripts for each Vlan as per the below article:
CentOS 8.x Configure ethernet port for 802.3 encapsulated trunk traffic communication
- Example Network script ( file name: ifcfg-ens33.99)
VLAN=yes TYPE=Vlan PHYSDEV=ens33 VLAN_ID=99 REORDER_HDR=yes GVRP=no MVRP=no HWADDR= PROXY_METHOD=none BROWSER_ONLY=no BOOTPROTO=none IPADDR=172.30.7.106 PREFIX=16 GATEWAY=172.30.0.1 DNS1=172.31.1.160 DNS2=8.8.8.8 DEFROUTE=yes IPV4_FAILURE_FATAL=no IPV6_DISABLED=yes IPV6INIT=no NAME=ens33.99 DEVICE=ens33.99 ONBOOT=yes
- Restart the Network
# systemctl restart NetworkManager
- Remove the main interface
# nmcli connection del <interface name>
- Ping to gateway should work for each sub-interface
- Should be able to access the Internet
Configure Postfix
Install postfix to enable the mail alerts for ARPwatch
Configure postfix as per the below article:
CentOS 8.x postfix send email through relay or smarthost with smtp authentication
Configure ARPwatch
- install ARPwatch
# dnf update # dnf install epel-release # dnf install arpwatch
- Start the service
# systemctl start arpwatch # systemctl status arpwatch
- Add the sub-interfaces to ARPwatch
# arpwatch -i <sub-interface>
- Restart the service
# systemctl restart arpwatch
- Check the Process to confirm that ARPwatch is running
# ps aux | grep arpwatch
- Example output
[root@localhost ~]# ps aux | grep arpwatch arpwatch 41710 0.0 0.3 40860 6656 ? Ss May13 0:21 /usr/sbin/arpwatch -u arpwatch -F -C root 41760 0.0 0.3 40976 6024 ? Ss May13 0:00 arpwatch -i ens33.40 root 41763 0.0 0.4 40976 8200 ? Ss May13 0:01 arpwatch -i ens33.99 root 44122 0.0 0.1 221664 2176 pts/2 S+ 16:45 0:00 grep --color=auto arpwatch
- Check logs in the following file
/var/log/messages
- Example mail alert output
hostname: <unknown> ip address: 172.30.30.25 ethernet address: bc:24:11:48:b3:56 ethernet vendor: Proxmox Server Solutions GmbH timestamp: Wednesday, May 14, 2025 15:46:10 +0530
Arpwatch alerts persist across reboots
- Create a systemd service file
vim /etc/systemd/system/arpwatch@.service
[Unit] Description=Arpwatch on %i After=network-online.target Wants=network-online.target [Service] Type=forking User=arpwatch Group=arpwatch AmbientCapabilities=CAP_NET_RAW ExecStartPre=/bin/sleep 5 ExecStart=/usr/sbin/arpwatch -i %i -f /var/lib/arpwatch/arp.%i -w alerts_gbb@gbb.co.in Restart=on-failure StandardOutput=null StandardError=null [Install] WantedBy=multi-user.target
- Before starting the service, manually create the database files:
touch /var/lib/arpwatch/arp.ens192.99
- Give permission to arpwatch user:
chown arpwatch:arpwatch /var/lib/arpwatch/arp.ens192.99
- Start and enable the service:
# systemctl start arpwatch@ens192.99 # systemctl enable arpwatch@ens192.99 # systemctl status arpwathc@ens192.99
- After few minutes, check the database file to view the alerts
vim /var/lib/arpwatch/ens192.99
Suppress flip flop and changed Ethernet address alerts
To suppress flip flop and changed Ethernet address alerts, we can use Postfix header_checks mechanism as a global filter.
- Create or edit a header checks file
vim /etc/postfix/header_checks
- Add rule
/^Subject:.*flip flop/ DISCARD /^Subject:.*changed ethernet address/ DISCARD
- Enable in main.cf
vim /etc/postfix/main.cf
header_checks = regexp:/etc/postfix/header_checks
- Reload postfix
postmap /etc/postfix/header_checks
postfix reload
This will drop the mail at the SMTP level, before delivery.
Reference
