DBS-ARPWATCH, NETWORKING, ARP packet sniffer DBS-ARPWATCH sniffs the ethernet for ARP packets. This tool is not complete i.e. the documentation etc. is not finished yet. ARPwatch is a utility that watches for APR packets that signal when a new IP address is related to an ethernet address. This protocol is used with TCP/IP, but if someone attempts to have a machine pretend to be a different one (take over someone else's IP address) they may use spoofed ARP packets which ARPwatch will notice. This happens at times in connection hijacking. ARP packets only live on one ethernet segment.