This program uses thesniff() callback (paramterprn). Thestoreparameter is set to 0 so thatsniff() will not store anything (as itwould do otherwise) and thus can run forever. Thefilter parameteris used for better performances on high load: the filter is appliedinside the kernel and Scapy will only see ARP traffic.

#! /usr/bin/env pythonfromscapyimport*defarp_monitor_callback(pkt):ifARPinpktandpkt[ARP].opin (1,2):#who-has or is-atreturnpkt.sprintf("%ARP.hwsrc% %ARP.psrc%")sniff(prn=arp_monitor_callback,filter="arp",store=0)