#Oct 20 16:09:05 atena arpwatch: flip flop 172.20.31.33 0:14:38:cc:80:d5 (0:30:c1:61:c:59) vlan0031
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ arpwatch: flip flop [.0-9]+ ([a-f0-9]{1,2}:){5}[a-f0-9]{1,2} \(([a-f0-9]{1,2}:){5}[a-f0-9]{1,2}\) vlan0031$
