Origianl idea comes from Matthias Andree.

diff -Naru arpwatch-2.1a15.orig/arpwatch.8 arpwatch-2.1a15/arpwatch.8
--- arpwatch-2.1a15.orig/arpwatch.8	2006-09-24 09:34:36.000000000 +0400
+++ arpwatch-2.1a15/arpwatch.8	2006-09-24 10:06:24.000000000 +0400
@@ -27,7 +27,12 @@
 .na
 .B arpwatch
 [
-.B -dN
+.B -d
+]
+.br
+.ti +9
+[
+.B -F
 ]
 .br
 .ti +9
@@ -50,6 +55,11 @@
 .br
 .ti +9
 [
+.B -N
+]
+.br
+.ti +9
+[
 .B -r
 .I file
 ]
@@ -115,6 +125,14 @@
 .IR stderr .
 .LP
 The
+.B -F
+flag is used to prevent 
+.I arpwatch
+from forking. This is allows to run
+.I arpwatch
+from daemon tools.
+.LP
+The
 .B -f
 flag is used to set the ethernet/ip address database filename.
 The default is
diff -Naru arpwatch-2.1a15.orig/arpwatch.c arpwatch-2.1a15/arpwatch.c
--- arpwatch-2.1a15.orig/arpwatch.c	2006-09-24 09:34:36.000000000 +0400
+++ arpwatch-2.1a15/arpwatch.c	2006-09-24 10:10:17.000000000 +0400
@@ -179,10 +179,12 @@
 	struct bpf_program code;
 	char errbuf[PCAP_ERRBUF_SIZE];
 	char* username = NULL;
+	int nofork = 0;
 	int restart = 0;
 	int restarting_loop = 0;
 	char options[] =
 		"d"
+		"F"
 		"f:"
 		"i:"
 		"n:"
@@ -229,6 +231,10 @@
 #endif
 			break;
 
+		case 'F':
+			++nofork;
+			break;
+
 		case 'f':
 			arpfile = optarg;
 			break;
@@ -319,12 +325,14 @@
 
 		/* Drop into the background if not debugging */
 		if (!debug) {
-			pid = fork();
-			if (pid < 0) {
-				syslog(LOG_ERR, "main fork(): %m");
-				exit(1);
-			} else if (pid != 0)
-				exit(0);
+			if (!nofork) {
+				pid = fork();
+				if (pid < 0) {
+					syslog(LOG_ERR, "main fork(): %m");
+					exit(1);
+				} else if (pid != 0)
+					exit(0);
+			}
 			(void)close(fileno(stdin));
 			(void)close(fileno(stdout));
 			(void)close(fileno(stderr));