Install and Use Arpwatch on AlmaLinux 9: Free Network Monitor

This tutorial will guide you through the process of how to Install and Use Arpwatch on AlmaLinux 9. Arpwatch is an invaluable open-source tool designed to monitor Address Resolution Protocol traffic on your network. With Arpwatch, you can maintain a detailed log or database of all Ethernet and IP address pairings, providing a comprehensive record of identified IP and MAC address associations along with their timestamps. The ability to effectively Install and Use Arpwatch on AlmaLinux 9 can greatly improve network security.

Arpwatch leverages pcap to passively listen to ARP packets on the local network. This allows it to monitor ARP activity and detect potential issues such as ARP spoofing, network flip-flops, changes in network stations, and address reuse. Furthermore, it has the capability to report these changes via email, providing real-time alerts for any suspicious activity. Understanding how to Install and Use Arpwatch on AlmaLinux 9 is a crucial skill for network administrators.

Now, let’s follow the steps outlined below to successfully Install and Use Arpwatch on AlmaLinux 9.

To complete this guide, you must log in to your server as a non-root user with sudo privileges. To do this, you can follow our guide on Initial Server Setup with AlmaLinux 9.

1. Install the Arpwatch Tool on AlmaLinux 9

Arpwatch packages are conveniently available through the EPEL (Extra Packages for Enterprise Linux) repository.

First, refresh your local package index using the following command:

sudo dnf update -y

Next, install the EPEL repository using the following command:

sudo dnf install epel-release -y

It’s good practice to run the system update again after enabling EPEL:

sudo dnf update -y

Now, you can effortlessly install Arpwatch using the command below:

sudo dnf install arpwatch -y

You can verify that Arpwatch has been successfully installed on your AlmaLinux 9 system by checking its version:

arpwatch -V

**Output**
Version 3.3

2. How To Use Arpwatch Tool?

With Arpwatch now installed, you can begin monitoring specific ethernet network interfaces. The general syntax is:

arpwatch -i <interface-name>

For example, to monitor the eth0 network interface, use the command below:

sudo arpwatch -i eth0

This command won’t produce any immediate output. Instead, it runs in the background, quietly monitoring network traffic. It logs information to /var/log/messages.

To view the logged information, use the following command:

sudo tail -f /var/log/messages

For comprehensive details, consult the Arpwatch man page:

man arpwatch

Here are some common options for the Arpwatch Tool:

Option	Description
`-d`	Run in the foreground (do not daemonize).
`-e email`	Specify the email address for notifications.
`-f datafile`	Specify the path to the ARP database file (default: `/var/lib/arpwatch/arp.dat`).
`-i interface`	Specify the network interface to monitor (e.g., `eth0`, `wlan0`).
`-n net[/width]`	Limit monitoring to a specific network or subnet.
`-r file`	Read ARP packets from a saved file (e.g., a `.pcap` file).
`-N`	Do not report any new activity (disable notifications for new addresses).
`-u user`	Run the process as the specified user.

The important file location of Arpwatch:


`/etc/sysconfig/arpwatch`	Key system configuration file for this tool.
`/usr/sbin/arpwatch`	The main folder of ArptWatch where its binary is located.
`/var/lib/arpwatch/arp.dat`	ARP Dat is a file to store the database of Ethernet MAC addresses seen on the network.
`/var/log/messages`	File that logs the details of changes that happen over Ip or mac-address.

3. Uninstall Arpwatch From AlmaLinux 9

If you no longer require Arpwatch, you can easily remove it using the command below:

sudo dnf remove arpwatch -y

Conclusion

Arpwatch is a valuable network monitoring tool for tracking Ethernet and IP address pairings (MAC-to-IP mappings) on a network. You have now successfully learned how to Install and Use Arpwatch on AlmaLinux 9.

Hope you enjoy it. Please subscribe to us on Facebook, Twitter, and YouTube.

FAQs

How does Arpwatch notify about network changes?

By default, it sends alerts via email to the configured recipient in /etc/sysconfig/arpwatch.

Can Arpwatch detect ARP spoofing attacks?

Yes, Arpwatch detects ARP spoofing by identifying unexpected changes in MAC-to-IP mappings.

Alternative Solutions for Network Monitoring

While Arpwatch is a solid choice for ARP monitoring, other tools and approaches can provide broader or more specialized network monitoring capabilities. Here are two alternative solutions:

1. Using `tcpdump` and Scripting for Customized Monitoring

tcpdump is a powerful command-line packet analyzer that allows you to capture and inspect network traffic. By combining tcpdump with scripting (e.g., Bash or Python), you can create custom monitoring solutions tailored to your specific needs. This method provides more flexibility than Arpwatch but requires more effort to set up and maintain.

Explanation:

tcpdump captures packets: You can filter packets based on various criteria (e.g., ARP, IP address, port).
Scripting processes the output: The script analyzes the captured packets and performs actions based on the analysis (e.g., logging, alerting).

Example (Bash):

This example captures ARP packets and logs the MAC and IP addresses to a file. It also emails a notification if a new MAC address is detected.

#!/bin/bash

LOG_FILE="/var/log/arp_monitor.log"
KNOWN_MACS="/var/lib/arp_monitor/known_macs.txt"
EMAIL="admin@example.com"

# Create directories if they don't exist
mkdir -p /var/lib/arp_monitor

# Create the known_macs.txt file if it doesn't exist
if [ ! -f "$KNOWN_MACS" ]; then
  touch "$KNOWN_MACS"
fi

tcpdump -i eth0 -n arp | while read line; do
  # Extract MAC and IP addresses
  mac=$(echo "$line" | awk '{print $4}' | cut -d ' ' -f 1)
  ip=$(echo "$line" | awk '{print $2}' | cut -d ' ' -f 1)
  timestamp=$(date +"%Y-%m-%d %H:%M:%S")

  # Log the ARP information
  echo "$timestamp - IP: $ip, MAC: $mac" >> "$LOG_FILE"

  # Check if MAC address is new
  if ! grep -q "$mac" "$KNOWN_MACS"; then
    echo "$mac" >> "$KNOWN_MACS"
    echo "New MAC address detected: $mac (IP: $ip)" | mail -s "ARP Alert" $EMAIL
  fi
done

How to Use:

Save the script to a file (e.g., arp_monitor.sh).
Make the script executable: chmod +x arp_monitor.sh.
Run the script as root (or with sudo): sudo ./arp_monitor.sh. Running the script in the background is also recommended: sudo ./arp_monitor.sh &

Pros:

Highly customizable.
Can be used for a wider range of network monitoring tasks beyond ARP.
No need to install additional packages (if tcpdump is already installed).

Cons:

Requires more technical expertise to set up and maintain.
More resource-intensive than Arpwatch.

2. Using Nmap for Network Discovery and Monitoring

Nmap is a powerful network scanner that can be used for various tasks, including host discovery, service enumeration, and security auditing. While not specifically designed for ARP monitoring, Nmap can be used to periodically scan the network and identify new or changed devices based on their MAC and IP addresses.

Explanation:

Nmap scans the network: Nmap sends packets to the network and analyzes the responses to identify active hosts and their MAC addresses.
Scripting compares results: A script compares the current scan results with previous results to detect changes.

Example (Nmap command and Python snippet):

First, run an Nmap scan and save the output to an XML file:

nmap -sn 192.168.1.0/24 -oX scan_result.xml

Then, use a Python script to parse the XML and identify new hosts:

import xml.etree.ElementTree as ET
import os

def parse_nmap_xml(xml_file, known_hosts_file):
    """Parses Nmap XML output and identifies new hosts."""
    tree = ET.parse(xml_file)
    root = tree.getroot()

    new_hosts = []
    for host in root.findall('host'):
        address = host.find('address[@addrtype="ipv4"]')
        mac_address = host.find('address[@addrtype="mac"]')

        if address is not None and mac_address is not None:
            ip = address.get('addr')
            mac = mac_address.get('addr')

            if not is_known_host(ip, mac, known_hosts_file):
                new_hosts.append((ip, mac))

    return new_hosts

def is_known_host(ip, mac, known_hosts_file):
    """Checks if a host is already known."""
    if not os.path.exists(known_hosts_file):
        return False

    with open(known_hosts_file, 'r') as f:
        for line in f:
            known_ip, known_mac = line.strip().split(',')
            if ip == known_ip and mac == known_mac:
                return True

    return False

def save_new_hosts(new_hosts, known_hosts_file):
    """Saves new hosts to the known hosts file."""
    with open(known_hosts_file, 'a') as f:
        for ip, mac in new_hosts:
            f.write(f"{ip},{mac}n")

def main():
    xml_file = "scan_result.xml"
    known_hosts_file = "known_hosts.txt"

    new_hosts = parse_nmap_xml(xml_file, known_hosts_file)

    if new_hosts:
        print("New hosts found:")
        for ip, mac in new_hosts:
            print(f"IP: {ip}, MAC: {mac}")
        save_new_hosts(new_hosts, known_hosts_file)
    else:
        print("No new hosts found.")

if __name__ == "__main__":
    main()