Arpalert
Arpalert uses ARP address monitoring to help prevent unauthorized connections on the local network. If an illegal connection is detected, a program or script is launched, which could be used to send an alert message, for example.
This software is used for monitoring ethernet networks.
It listens on a network interface (without using 'promiscuous' mode) and catches all conversations of MAC address to IP request.
It then compares the mac addresses it detected with a pre-configured list of authorized MAC addresses. If the MAC is not in list, arpalert launches a pre-defined user script with the MAC address and IP address as parameters.
This software can run in deamon mode; it's very fast (low CPU and memory consumption).
It responds at signal SIGHUP (configuration reload) and at signals SIGTERM, SIGINT, SIGQUIT and SIGABRT (arpalert stops itself)