ARP Monitoring

The program allows you to monitor hosts via the ARP protocol and monitor MAC address changes with the help of the ARP monitoring check.

ARP (Address Resolution Protocol) – very widespread, crucial protocol. Its functions include linking the physical (MAC) and logical (IP) addresses of a host when exchanging data over network. It can be also used for checking the availability of a host on the network. Before creating a connection to some device on the network, the IP protocol checks its ARP cache to find out whether the data on the recipient host, necessary for establishing the connection, is registered in it already. If the record is absent in the ARP cache, the application sends a broadcast ARP request. For devices on the network, the request means the following: “Does anybody know the physical address of the device with this IP address?” When the recipient receives that packet, it would have to reply: “Yes, that's my IP address, and here is my physical address: …” . That reply will indicate that the host is available and responds to queries. To put it simpler, the program attempts to determine the MAC address of a specified host by its IP address. If the MAC address can be obtained and is equal to the specified one, the check is considered passed.

So, you can monitor MAC address changes using this ARP monitoring check. The program will prompt you if the specified MAC address is changed.

In order to add this check, select a host, then click "Add check", and find the necessary monitoring check name on the Wizard window.

Configure the check parameters on the displayed window. You can modify the parameters later using the "Edit Check..." menu item. Learn more on how to configure the check alerts and other options here.

Requirements: Windows XP/Vista/7/8.1/10/11, Server 2003/2008/2012/2016/2019/2022 supported.