arpalert listens on a network interface (without using 'promiscuous' mode)
and catches all conversations of MAC address to IP request.
It then compares the mac addresses it detected with a pre-configured list
of authorized MAC addresses. If the MAC is not in list, arpalert launches
a pre-defined user script with the MAC address and IP address as parameters.
This software can run in daemon mode; it's very fast (low CPU and memory
consumption).