arpwatch package seems to be missing from Redhat Linux
package selection list.
Currently the component list is built upon the srpms that redhat ships
rather than the binary rpms. Therefore arpwatch is provided by the
tcpdump srpm. This is likely to change in the near future to provide a
more detailed list of possible components. Until then please determine
the component to choose by running rpm -qi on the rpm and finding what
source rpm the program came from.