Keep track of ethernet/ip address pairings. It syslogs activity and reports certain changes via email.
ssmtp
. apt install ssmtp mailutils
apt install arpwatch systemctl stop arpwatch rm /var/lib/arpwatch/* # remove already found hosts
cd /usr/share/arpwatch/ mv ethercodes.dat ethercodes.old curl -O https://linuxnet.ca/ieee/oui/ethercodes.dat
/etc/arpwatch.conf
eth0 -m <mail recipient>
systemctl enable arpwatch systemctl start arpwatch