arpmon for OSX

#!/bin/bash
#This script monitors the MAC address of your default gateway and alerts you via Growl of changes
function getmac {
dg=$(netstat -rn | grep -Eo 'default.*([0-9]{1,3}\.){3}[0-9]{1,3}')     #grab the default gateway (DG)
dg_ip=$(echo $dg | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}')          #strip the DG to just IP
dg_arp=$(arp -a | grep -w $dg_ip)                                   #grab the arp entry for DG
dg_mac=$(echo $dg_arp | grep -Eo '[0-9a-f]{1,2}[:-][0-9a-f]{2}[:-][0-9a-f]{2}[:-][0-9a-f]{2}[:-][0-9a-f]{2}[:-][0-9a-f]{2}') #strip the ARP entry to just the MAC
}

function stop {
arpmon_pid=$(ps ax | grep arpmon | cut -d" " -f1) #find the PID for arpmon
kill $arpmon_pid
}

case "$1" in
    start)
        getmac #run the function to get the IP and ARP of the DG
        kg_mac=$dg_mac #keep the initial ARP entry as the known good MAC

        while true;do
            getmac #re-run the function to find the current MAC for the DG
            if [ $dg_mac != $kg_mac ]; #has the MAC address changed

            then #if so run growlnotify
                growlnotify -p 2 -w -m "The MAC address for your Default Gateway ($dg_ip) has changed from $kg_mac to $dg_mac."
            fi
        sleep 5 #wait five seconds and rerun
        done
;;

    stop)
        stop
        ;;

    *)
        echo "Usage: arpmon {start|stop}"
        exit 1
esac
exit 0