<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting ARP Spoofing — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-arp-spoofing.

## Tools


### `arpwatch`

Ethernet/IP address pairing monitor

**Usage:**
```bash
arpwatch -i <interface> -f <datafile>
```

**Key Flags:**
  - `-i: interface to monitor`
  - `-f: data file for IP/MAC pairs`
  - `-n: additional networks to watch`

---

### `arp-scan`

ARP scanner for local network discovery

**Usage:**
```bash
arp-scan --localnet --interface=<iface>
```

**Key Flags:**
  - `--localnet: scan local network`
  - `--interface: specify interface`
  - `-D: detect duplicates`

---

### `arp`

ARP table management utility

**Usage:**
```bash
arp -an
```

**Key Flags:**
  - `-a: display all entries`
  - `-s: set static entry`
  - `-d: delete entry`
  - `-n: numeric output`

---


## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
