ARP Table Monitoring: Detect MAC Spoofing and Network Anomalies on Linux

Understanding ARP

ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses on local networks. The ARP cache stores recent mappings. Attackers exploit ARP to redirect traffic via MAC spoofing.

Viewing the ARP Table

arp -a
ip neigh show
cat /proc/net/arp

Detecting Anomalies

# Duplicate MACs (possible spoofing)
ip neigh | awk "{print \$5}" | sort | uniq -d

# Stale entries
ip neigh show | grep STALE

# Incomplete (no response)
ip neigh show | grep INCOMPLETE

ARP Cache Management

ip neigh flush dev eth0
arp -d 192.168.1.1
ip neigh add 192.168.1.1 lladdr aa:bb:cc:dd:ee:ff dev eth0

Automated Monitoring with dargslan-arp-monitor

pip install dargslan-arp-monitor
dargslan-arp-monitor