---
name: "arpsnmp"
section: "8"
platform: "linux"
package: "arpwatch"
version: "3.9-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/arpsnmp"
---

# arpsnmp(8)

keep track of ethernet/ip address pairings

## NAME

**arpsnmp** – keep track of ethernet/ip address pairings

## SYNOPSIS

**arpsnmp** \[**-dqs**\] \[**-D** *arpdir*\] \[**-f** *datafile*\] \[**-w** *watcher@email*\] \[**-W** *watchee@email*\] *file* *...*

## DESCRIPTION

**arpsnmp** keeps track of ethernet/ip address pairings. It syslogs activity and reports certain changes via email. **arpsnmp** reads information from a file (usually generated by snmpwalk(3)).

The format of the input file is the same as *arp.dat*; the mac address, ip address, optional timestamp and optional simple hostname. If the timestamp is missing, the current date is used.

**arpsnmp** can also be used to merge files. If the same ethernet/ip address pair occurs in more than one file, the timestamp from the last seen is saved.

The **-C** flag uses compact padded ethernet addresses in *arp.dat*, e.g. 0:8:e1:1:2:d6.

The **-d** flag is used enable debugging. This also inhibits mailing the reports. Instead, they are sent to *stderr*.

The **-D** flag is used to specify the working directory. This defaults to */usr/local/arpwatch*.

The **-f** flag is used to set the ethernet/ip address database filename. The default is *arp.dat*.

Note that an empty file must be created before the first time you run

The **-q** flag suppresses reports being logged or printed to *stderr*.

The **-s** flag suppresses reports sent by email.

The **-w** flag is used to specify the target address for email reports. The default is *root*.

The **-W** flag is used specifies the from address for email reports. The default is *root*.

The **-Z** flag uses zero padded ethernet addresses in *arp.dat*, e.g. 00:08:e1:01:02:d6.

## REPORT MESSAGES

See the arpwatch(1) man page for details on the report messages generated by arpsnmp(1).

## FILES

- */usr/local/arpwatch*

  default directory

- *arp.dat*

  default ethernet/ip address database

- *ethercodes.dat*

  vendor ethernet block list

## SEE ALSO

[arpwatch(8)](/arpwatch/8.md), snmpwalk(8), [arp(8)](/arp/8.md),

## AUTHORS

Craig Leres of the Lawrence Berkeley National Laboratory Network Research Group, University of California, Berkeley, CA.

The current version is available via anonymous ftp:

```
ftp://ftp.ee.lbl.gov/arpwatch.tar.gz
```

## BUGS

Please send bug reports to ⟨arpwatch@ee.lbl.gov⟩.

It doesn't make any sense to feed **arpsnmp** the *arp.dat* file.

Attempts are made to suppress DECnet flip flops but they aren't always successful.