ARPwatch
From Notes_Wiki
Home > Rocky Linux or CentOS > Rocky Linux 9.x > Rocky 9.x Network Monitoring Tools > ARPwatch
Create Virtual Machine
- Create a Rocky 9.x VM in the Vcenter
- Select All VLANs Trunk in Network Adapter while creating the Virtual Machine
Configure Network Scripts
Create Network Scripts for each Vlan as per the below article:
CentOS 8.x Configure ethernet port for 802.3 encapsulated trunk traffic communication
- Example Network script ( file name: ifcfg-ens33.99)
VLAN=yes TYPE=Vlan PHYSDEV=ens33 VLAN_ID=99 REORDER_HDR=yes GVRP=no MVRP=no HWADDR= PROXY_METHOD=none BROWSER_ONLY=no BOOTPROTO=none IPADDR=172.30.7.106 PREFIX=16 GATEWAY=172.30.0.1 DNS1=172.31.1.160 DNS2=8.8.8.8 DEFROUTE=yes IPV4_FAILURE_FATAL=no IPV6_DISABLED=yes IPV6INIT=no NAME=ens33.99 DEVICE=ens33.99 ONBOOT=yes
- Restart the Network
# systemctl restart NetworkManager
- Remove the main interface
# nmcli connection del <interface name>
- Ping to gateway should work for each sub-interface
- Should be able to access the Internet
Configure Postfix
Install postfix to enable the mail alerts for ARPwatch
- Install the required packages
# dnf -y install epel-release # dnf -y install cyrus-sasl cyrus-sasl-plain cyrus-sasl-lib postfix # dnf -y install s-nail
- Configure the following in main.cf file
# vim /etc/postfix/main.cf
- add the following entries in their respective locations:
myhostname = <hostname>
mydomain = <hostname>
inet_interfaces = all
inet_protocols = ipv4
mynetworks = 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8
- add the following at the bottom of the document:
smtp_sasl_auth_enable = yes smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd smtp_sasl_security_options = smtp_tls_security_level = may relayhost = <mail-server>:<port> sender_canonical_maps = hash:/etc/postfix/sender_canonical
- Add the crendentials
# vim /etc/postfix/sasl_passwd <mail-server>:<port> <username>:<password>
- rewrite all mails from root to sender
# vim /etc/postfix/sender_canonical
root <email-id>
root@<hostname> <email-id>
Add the sender’s address in aliases file
# vim /etc/aliases root: <mail-id> # newaliases
- Give Permission and create the postmap hash
# cd /etc/postfix # chmod 600 sasl_passwd # postmap hash:/etc/postfix/sasl_passwd # postmap /etc/postfix/sender_canonical
- restart the service
# systemctl restart postfix.service # postfix reload
- test the outgoing mail
echo "Test email using postfix" | mail -s "Relay test with smtp authentication" <mail-id>
Configure ARPwatch
- install ARPwatch
# dnf install arpwatch
- Start the service
# systemctl start arpwatch # systemctl status arpwatch
- Add the Vlans to ARPwatch
# arpwatch -i <sub-interface>
- Check the Process to confirm that ARPwatch is running
# ps aux | grep arpwatch
- Example output
[root@localhost ~]# ps aux | grep arpwatch arpwatch 41710 0.0 0.3 40860 6656 ? Ss May13 0:21 /usr/sbin/arpwatch -u arpwatch -F -C root 41760 0.0 0.3 40976 6024 ? Ss May13 0:00 arpwatch -i ens33.40 root 41763 0.0 0.4 40976 8200 ? Ss May13 0:01 arpwatch -i ens33.99 root 44122 0.0 0.1 221664 2176 pts/2 S+ 16:45 0:00 grep --color=auto arpwatch
- Check logs in the following file
/var/log/messages
- Example mail alert output
hostname: <unknown> ip address: 172.30.30.25 ethernet address: bc:24:11:48:b3:56 ethernet vendor: Proxmox Server Solutions GmbH timestamp: Wednesday, May 14, 2025 15:46:10 +0530
- Reference
