arpcheck checks /proc/net/arp for MAC/IP combinations and compares them to a static list (shorewall style) or a dynamically learned MAC list. If a rogue MAC/IP is found, arpcheck alerts you.
67cda0930283469be20ea4838b22386519cbac3fdfbc70e2a3b5aad1999acf83