Linux arpwatch Command with Practical Examples

Introduction

In this lab, you will learn how to use the arpwatch command in Linux to monitor network activity and detect potential security issues. arpwatch is a network monitoring tool that tracks changes in Ethernet/IP address pairings, which can be useful for identifying ARP spoofing attacks and monitoring network behavior. You will start by understanding the purpose and functionality of arpwatch, then install it on your Ubuntu 22.04 system, and finally learn how to use it to monitor network activity. The lab covers the necessary steps to get started with arpwatch and provides practical examples of its usage.

Linux Commands Cheat Sheet

Skills Graph

Understand the Purpose and Functionality of arpwatch

In this step, you will learn about the purpose and functionality of the arpwatch command in Linux. arpwatch is a network monitoring tool that tracks changes in Ethernet/IP address pairings on a network.

arpwatch monitors network traffic and logs any changes in the ARP (Address Resolution Protocol) table, which maps IP addresses to MAC addresses. This information can be useful for detecting network security issues, such as ARP spoofing attacks, and for monitoring network activity.

Let's start by understanding the basic usage of arpwatch:

sudo apt-get update
sudo apt-get install -y arpwatch

The above commands will install the arpwatch package on your Ubuntu 22.04 system.

Once installed, you can start the arpwatch service:

sudo arpwatch

This will start the arpwatch daemon and begin monitoring your network for any ARP table changes.

Example output:

arpwatch: listening on eth0

The arpwatch command has several options and configurations that allow you to customize its behavior, such as specifying the network interface to monitor, setting email notifications, and configuring log file locations.

To learn more about the available options, you can check the arpwatch man page:

man arpwatch

This will provide detailed information about the arpwatch command and its various options.

Install arpwatch on Ubuntu 22.04

In this step, you will learn how to install the arpwatch package on your Ubuntu 22.04 system.

First, let's update the package index:

sudo apt-get update

Next, install the arpwatch package:

sudo apt-get install -y arpwatch

This will install the arpwatch package and its dependencies on your system.

Once the installation is complete, you can start the arpwatch service:

sudo arpwatch

This will start the arpwatch daemon and begin monitoring your network for ARP table changes.

Example output:

arpwatch: listening on eth0

You can also check the status of the arpwatch service:

sudo systemctl status arpwatch

This will show the current status of the arpwatch service.

Monitor Network Activity with arpwatch

In this final step, you will learn how to use the arpwatch command to monitor network activity on your Ubuntu 22.04 system.

First, let's start the arpwatch service if it's not already running:

sudo arpwatch

This will start the arpwatch daemon and begin monitoring your network.

By default, arpwatch logs its output to the /var/log/arpwatch.log file. You can view the log file using the following command:

sudo tail -n 20 /var/log/arpwatch.log

This will display the last 20 entries in the arpwatch log file.

Example output:

Aug 23 14:32:01 myhost arpwatch[12345]: new station 192.168.1.100 0:11:22:33:44:55
Aug 23 14:33:15 myhost arpwatch[12345]: changed ethernet address 192.168.1.101 0:66:77:88:99:aa -> 0:aa:bb:cc:dd:ee

The log entries show when a new station is detected on the network (new IP-to-MAC address mapping) or when an existing mapping changes.

You can also configure arpwatch to send email notifications when it detects changes in the ARP table. To do this, you'll need to configure the email settings in the arpwatch configuration file located at /etc/arpwatch.conf.

sudo nano /etc/arpwatch.conf

In the configuration file, uncomment the ARPWATCH_EMAIL and ARPWATCH_SUBJECT lines and update them with your email settings.

After making the changes, save the file and restart the arpwatch service:

sudo systemctl restart arpwatch

Now, arpwatch will send email notifications whenever it detects changes in the ARP table.

Summary

In this lab, you learned about the purpose and functionality of the arpwatch command in Linux. arpwatch is a network monitoring tool that tracks changes in Ethernet/IP address pairings on a network, which can be useful for detecting network security issues and monitoring network activity. You then learned how to install the arpwatch package on your Ubuntu 22.04 system and start the arpwatch service to begin monitoring your network.

Linux Commands Cheat Sheet