arp-watch

# Description

arp-watch (cpp-arp-watch) is a Linux kernel ARP table monitor written in C++23 with no external dependencies. It reads /proc/net/arp to decode IP, HW type, hex flags, MAC, mask and interface. ATF_* flags: C=complete (valid MAC), P=permanent, p=publish/proxy ARP, T/N/D. Classifies REACH vs INCOMP and multicast (I/G bit), broadcast ff:ff:ff:ff:ff:ff and locally-administered (U/L bit) MACs. Aggregates: entries, complete, incomplete, permanent, publish, mcast/bcast and ifaces. Sort: interface, complete first, IP. Watch mode (--watch N) with count deltas between snapshots. JSON (--json) with summary + neighbors array. --demo multi-iface (eth0, br-lan, docker0, wlan0). Filters --iface IF and --incomplete. --no-color with a mutable ANSI palette (0 escapes in pipes). Selftest 45 checks: flags, MAC parse, table parser (skips # comments), demo, JSON, live /proc read. Zero deps: g++ -std=c++23 -O2 -Wall -Wextra.

$ ./deploy.sh $ git clone

# Key features

$ Reads /proc/net/arp: IP, MAC, ATF_* flags, HW type and interface

$ Flags C=complete P=permanent p=publish T/N/D (linux/if_arp.h)

$ MAC classification: unicast / multicast / broadcast / locally-administered

$ REACH vs INCOMP states for unresolved neighbors

$ Watch mode (--watch N) with entry/complete/incomplete deltas

$ JSON output (--json) with summary + neighbors array (python -m json.tool)

$ --demo multi-iface (eth0/br-lan/docker0/wlan0) and --no-color with 0 ANSI codes

$ Selftest 45 checks + zero dependencies: g++ -std=c++23

# Gallery

Project terminal

Mobile view

# Technologies used

C++23