Skip to content


OPN-Arp on OPNSense allows you to send alerts when new devices are spotted on the network.



  • Install the opn-arp plugin via the community repo
  • Enable OPN-Arp under Services > OPN-Arp
  • Enable Monit under Services > Monit
  • Add a new entry under Service Tests Settings:
    • Name: MAC pair
    • Condition: content = "MAC pair"
    • Action: Alert for an email alert or Execute and /root/ for gotify (script below)
  • Add a new entry under Service Settings:
    • Name: MAC_PAIR
    • Type: File
    • Path: /var/log/system/latest.log
    • Tests: MAC Pair
  • Add a new entry under Alert Settings: (only for email alerts)
  • Fill the mail server details under general (only for email alerts)

Gotify Alerts

  • Connect to OPNSense via SSH
  • Execute touch /root/ && chmod +x /root/
  • Paste the following script into /root/
    if [[ $MONIT_DESCRIPTION =~ "MAC pair" ]]; then
            ip=$(echo $MONIT_DESCRIPTION | cut -d '(' -f 2  | cut -d ')' -f 1)
            mac=$(echo $MONIT_DESCRIPTION | cut -d '(' -f 2  | cut -d ')' -f 2)
            host=$(host $ip | cut -d ' ' -f 5)
            title="New device spotted"
            msg="IP: $ip - MAC: $mac - Hostname: $host"
    curl -X POST "" -F "title=$title" -F "message=$msg"
  • Edit and yourtoken accordingly
  • Set opnarp to execute with chmod +x /usr/local/etc/rc.d/opnarp (otherwise the service doesn't come up automatically on reboot)
  • Test it by running:

    echo "<29>1 2022-08-29T20:16:44+03:00 router.home root 59285 - [meta sequenceId=1] New IPv4/MAC pair seen: (" >> /var/log/system/latest.log

Last update: 2023-02-02
Created: 2022-08-30