ARPwatch

Home > Rocky Linux or CentOS > Rocky Linux 9.x > Rocky 9.x Network Monitoring Tools > ARPwatch

Create Virtual Machine

• Create a Rocky 9.x VM in the Vcenter
• Select All VLANs Trunk in Network Adapter while creating the Virtual Machine

Configure Network Scripts

Create Network Scripts for each Vlan as per the below article:

CentOS 8.x Configure ethernet port for 802.3 encapsulated trunk traffic communication

• Example Network script ( file name: ifcfg-ens33.99)

VLAN=yes
TYPE=Vlan
PHYSDEV=ens33
VLAN_ID=99
REORDER_HDR=yes
GVRP=no
MVRP=no
HWADDR=
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
IPADDR=172.30.7.106
PREFIX=16
GATEWAY=172.30.0.1
DNS1=172.31.1.160
DNS2=8.8.8.8
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6_DISABLED=yes
IPV6INIT=no
NAME=ens33.99
DEVICE=ens33.99
ONBOOT=yes

• Restart the Network

# systemctl restart NetworkManager

• Remove the main interface

# nmcli connection del <interface name>

• Ping to gateway should work for each sub-interface
• Should be able to access the Internet

Configure Postfix

Install postfix to enable the mail alerts for ARPwatch

Configure postfix as per the below article:

CentOS 8.x postfix send email through relay or smarthost with smtp authentication

Configure ARPwatch

• install ARPwatch

# dnf update
# dnf install epel-release
# dnf install arpwatch

• Start the service

# systemctl start arpwatch
# systemctl status arpwatch

• Add the sub-interfaces to ARPwatch

# arpwatch -i <sub-interface>

• Restart the service

# systemctl restart arpwatch

• Check the Process to confirm that ARPwatch is running

# ps aux | grep arpwatch

• Example output

[root@localhost ~]# ps aux | grep arpwatch
arpwatch   41710  0.0  0.3  40860  6656 ?        Ss   May13   0:21 /usr/sbin/arpwatch -u arpwatch -F -C
root       41760  0.0  0.3  40976  6024 ?        Ss   May13   0:00 arpwatch -i ens33.40
root       41763  0.0  0.4  40976  8200 ?        Ss   May13   0:01 arpwatch -i ens33.99
root       44122  0.0  0.1 221664  2176 pts/2    S+   16:45   0:00 grep --color=auto arpwatch

• Check logs in the following file

/var/log/messages

• Example mail alert output

hostname: <unknown>
ip address: 172.30.30.25
ethernet address: bc:24:11:48:b3:56
ethernet vendor: Proxmox Server Solutions GmbH
timestamp: Wednesday, May 14, 2025 15:46:10 +0530

Arpwatch alerts persist across reboots

• Create a systemd service file

vim /etc/systemd/system/arpwatch@.service

[Unit]
Description=Arpwatch on %i
After=network-online.target
Wants=network-online.target

[Service]
Type=forking
User=arpwatch
Group=arpwatch
AmbientCapabilities=CAP_NET_RAW
ExecStartPre=/bin/sleep 5
ExecStart=/usr/sbin/arpwatch -i %i -f /var/lib/arpwatch/arp.%i -w alerts_gbb@gbb.co.in
Restart=on-failure
StandardOutput=null
StandardError=null

[Install]
WantedBy=multi-user.target

• Before starting the service, manually create the database files:

touch /var/lib/arpwatch/arp.ens192.99

• Give permission to arpwatch user:

chown arpwatch:arpwatch /var/lib/arpwatch/arp.ens192.99

• Start and enable the service:

systemctl start arpwatch@ens192.99
systemctl enable arpwatch@ens192.99
systemctl status arpwathc@ens192.99

• After few minutes, check the database file to view the alerts

vim /var/lib/arpwatch/ens192.99

Suppress flip flop and changed Ethernet address alerts

To suppress flip flop and changed Ethernet address alerts, we can use Postfix header_checks mechanism as a global filter.

• Create or edit a header checks file

vim /etc/postfix/header_checks

• Add rule

/^Subject:.*flip flop/ DISCARD
/^Subject:.*changed ethernet address/ DISCARD

• Enable in main.cf

vim /etc/postfix/main.cf

header_checks = regexp:/etc/postfix/header_checks

• Reload postfix

postmap /etc/postfix/header_checks

postfix reload

This will drop the mail at the SMTP level, before delivery.

Reference

• CentOS 8.x postfix send email through relay or smarthost with smtp authentication
• https://www.tecmint.com/monitor-ethernet-activity-in-linux/