Arpwatch builds a little list of known devices by MAC and IP address pairings. If a new device shows up or an old device changes MAC or IP then you get an email alert. After a “learning” period" it is very handy for detecting not only new devices but also DHCP issues, or finding that new thing you just plugged in without having to look at the DHCP server. I often use it to figure out if guests are having trouble connecting (because they really wanted to connect then didnt) and showing up to assist before they have to ask. It’s very handy.