Netreact is a passive ARP scanner that logs ARP traffic and generates event notifications for network monitoring.
Passive ARP scanner with built-in support for generating event notifications
This tool is primarily used for monitoring ARP traffic on a network, helping network administrators detect unusual activity. It is particularly useful for identifying unauthorized devices or potential ARP spoofing attacks.
Ensure to run the tool with appropriate permissions to capture ARP traffic, and consider using inotifywait or fswatch for automated event handling.
Build the tool using the command: go build
Ensure you have 'libpcap-dev' installed if the build fails, depending on your Linux distribution../netreact -i eth0 -d events
Starts Netreact on interface eth0 and stores event files in the 'events' directory.
./netreact -i en0 -d events -f 'arp and src host not 0.0.0.0'
Starts Netreact on interface en0 with a custom BPF filter.
./netreact -i en0 -d events -u=false
Starts Netreact on interface en0 without the user interface.