I had set up Arpwatch on my office's pfSense 2.4.3 gateway. Ever since I had done that, I started getting a whole lot of emails - most of them very useful, while some are less useful.
I wonder if there is any way of restricting Arpwatch's reports only to new activity/new station, without the flip flop reports (which stand for 90% of all emails)?
Sure, I could use email filters as a last resort, but those emails are supposed to go to a whole team and not just me.
0 Answers