Hi,
why do you not parse the dcpd.log of your dhcp server to prevent this arp table parsing?

anyway for explaination:
- connect any cliente to a network > generates a dhcp log event
- if mac adresse is "any esp" >writeTo> esp.dhcp.log (or any other database thingy should be working well); if mac is ...