#first time occurs
 watchfor /arpwatch: changed ethernet address/
    exec /home/ammar/Desktop/net-idsekon2008/arpwall/alert.py
    bell 3
 #2nd time ...
 watchfor /arpwatch: flip flop/
     exec /home/ammar/Desktop/net-idsekon2008/arpwall/alert.py
     bell 3