arpsift.exe

Arpsift is a console utility. It watches the ARP table - providing a scrolling log of when entries are added, removed or changed. Additionally (if you press control-break) it provides its own version of "arp-a" - with the addition of activity timers and OUI lookups.

The key distinction between this utility and others that I have looked at is that it does not utilize a network sniffer - it is reading the data directly from the operating system. This means it has less data to work with - rather than watching all ARP activity on the network it is only aware of activity relevant to the local host. The benefit, however, is that arpsift does not require WinPcap to be installed. (Don't get me wrong, I love WinPcap - but it isn't always appropriate or possible to install a network driver on a machine if you're just trying to debug a quick ARP issue.)

Arpsift contains a bit of StackOverflow: here Thank you StackOverflow!

Download:

arpsift.exe

arpsift-src.zip

Usage:


Usage: arpsift [-d] [-w ms] [-o] [-f filename]

Options:
    -d  Do not include timestamp on every line
    -w X        Sleep X milliseconds between polls (default 1)
    -o  Do not include OUI information
    -f X        Specify that X is the OUI filename.  (default: oui.hex.txt)

The OUI file may be acquired from http://standards-oui.ieee.org/oui.txt
Also: http://standards.ieee.org/develop/regauth/iab/iab.txt
This tool only uses the (hex) lines.  For the sake of file size, you can
remove all other lines in the file.

Screenshots:

Scrolling output, including a MAC that has changed. (In this case, induced by creating a static entry):

Pressing control-break gets you the ARP Table, with bonus information that "arp-a" doesn't have. Idle(s) is the time in seconds since a particular entry has been modified (this time is internal to the utility - time is counted from when it starts up). OUI is available if you have an oui.hex.txt handy.

arpsift.exe

Download:

Usage:

Screenshots:

See also: