Observando um arpspoof em sua rede:
apt-get install arpwatch
arpwatch -i eth0
tail -f /var/log/syslog
Nov 10 22:29:48 rap arpwatch: changed ethernet address 172.16.0.102 00:a1:29:49:5b:92 (60:f4:59:27:9b:dc) eth0
Nov 10 22:29:48 rap arpwatch: changed ethernet address 172.16.0.102 00:a1:29:49:5b:92 (60:f4:59:27:9b:dc) eth0
Nov 10 22:29:48 rap arpwatch: reaper: pid 2827, exit status 1
Nov 10 22:29:48 rap arpwatch: reaper: pid 2828, exit status 1
