I've just set up Arpwatch on my pfSense machine and started getting emails about flip flops in my network. As the network is quite big, I understand that the flip flops indicate that a certain IP-address has now been assigned to a new device, with its own MAC-address.

What I don't understand (and it doesn't seem to be included in arpwatch's man-pages) is what does the term Delta stand for? I would guess it's the time difference between the timestamps, but what do they stand for?

An example of an email from Arpwatch follows below.

            hostname: <unknown>
          ip address:
    ethernet address: xxxxxxx
     ethernet vendor:  xxxx
old ethernet address: xxxxxxx
 old ethernet vendor:  xxxx
           timestamp: Monday, September 24, 2018 18:39:16 +0200
  previous timestamp: Monday, September 24, 2018 18:37:33 +0200
               delta: 1 minute

"delta" is just a standard mathematical expression for the difference between two measurements.

  • Often a capital delta: Δt means difference in t, often time, which would be worked out as t1 - t0
  • As lowercase is usually a variable representing the difference, sometimes used like this: t1 = t0 + δ

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.