The storage server at 192.168.10.20 should have the fixed hardware address 00:25:90:01:02:03, so the administrator suspects that another machine is spoofing the server's MAC. She needs a lightweight, agentless tool she can run on her monitoring VM that will passively watch ARP traffic, keep a history of IP-to-MAC bindings, and automatically email her whenever a different MAC appears for a known IP. Which package best meets these requirements with the least additional scripting?
Add an iptables LOG rule that matches -m mac --mac-source 00:25:90:01:02:03 on the gateway.
Schedule arping -D in a cron job to probe the server's IP every minute.
Run tcpdump with ether host 00:25:90:01:02:03 and process the capture with logrotate.
Install and enable the arpwatch service to log ARP changes and send email alerts.
Arpwatch is purpose-built to listen passively to ARP packets, maintain a database of observed IP/MAC pairings, and send email whenever a pairing changes or a new one is seen, making it ideal for detecting MAC spoofing. Arping in duplicate-address-detection mode actively probes a single IP and has no persistence or alerting. Tcpdump can capture ARP frames but would require custom parsing, storage, and notification logic. A netfilter rule that logs packets from a specific MAC will not notice a different device using that IP/MAC combination or build historical data. Therefore, deploying arpwatch is the most effective solution for the scenario described.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What does ARP mean and how does it work?
Open an interactive chat with Bash
How does Arpwatch help with detecting MAC address spoofing?
Open an interactive chat with Bash
What is the difference between active and passive network monitoring, and why is passive suited for this scenario?
Open an interactive chat with Bash
CompTIA Linux+ XK0-006 (V8)
Troubleshooting
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
Pass with Confidence.
IT & Cybersecurity Package
You have hit the limits of our free tier, become a Premium Member today for unlimited access.
Military, Healthcare worker, Gov. employee or Teacher? See if you qualify for a Community Discount.
Monthly
$19.99
$19.99/mo
Billed monthly, Cancel any time.
3 Month Pass
$44.99
$14.99/mo
One time purchase of $44.99, Does not auto-renew.
MOST POPULAR
Annual Pass
$119.99
$9.99/mo
One time purchase of $119.99, Does not auto-renew.
BEST DEAL
Lifetime Pass
$189.99
One time purchase, Good for life.
What You Get
All IT & Cybersecurity Package plans include the following perks and exams .