Arpwatch

Keeps track of Ethernet/IP address pairings and can detect classic ARP man-in-the-middle attacks. In addition, it syslogs activity and reports changes via email. This tool uses LibPcap to listen for ARP packets on a local Ethernet interface