I've just set up Arpwatch on my pfSense machine and started getting emails about flip flops in my network. As the network is quite big, I understand that the flip flops indicate that a certain IP-address has now been assigned to a new device, with its own MAC-address.
What I don't understand (and it doesn't seem to be included in arpwatch's man-pages) is what does the term Delta stand for? I would guess it's the time difference between the timestamps, but what do they stand for?
An example of an email from Arpwatch follows below.
hostname: <unknown> ip address: 10.16.100.100 ethernet address: xxxxxxx ethernet vendor: xxxx old ethernet address: xxxxxxx old ethernet vendor: xxxx timestamp: Monday, September 24, 2018 18:39:16 +0200 previous timestamp: Monday, September 24, 2018 18:37:33 +0200 delta: 1 minute