arpwatch - 2.1a15-9 main

Arpwatch maintains a database of Ethernet MAC addresses seen on the
network, with their associated IP pairs. Alerts the system administrator
via e-mail if any change happens, such as new station/activity,
flip-flops, changed and re-used old addresses.
.
If you want to maintain a list authorized MAC addresses manually, take a look
at the arpalert package which may fit your needs better.