How to detect ARP spoofing from a packet capture

ARP maps IP addresses to hardware addresses on a local network, and it trusts whatever it hears. A machine that answers "the gateway is at my MAC address" can put itself in the middle of its neighbours' traffic. The lie has to be repeated to stick, and that repetition is visible in a capture.

1. How ARP spoofing works

To send a packet to the gateway, a host asks "who has 192.168.1.1?" and caches the MAC address in the reply. Hosts also accept replies they never asked for. An attacker sends forged replies to each victim, saying the gateway's address belongs to the attacker's MAC, and the victims start sending their traffic to the attacker. It forwards the traffic on, reading or altering it as it passes.

Cache entries expire after a short while, so the attacker re-sends the forged replies every few seconds. A capture therefore shows one IP address answered for by two hardware addresses, again and again.

2. Capture in the right place

ARP never leaves the local network segment, and forged replies are usually sent directly to each victim rather than broadcast. A capture on one ordinary host sees only the replies aimed at that host. For a full picture, capture on a victim's own machine, or from a switch port mirroring (SPAN) the access switch that serves the segment. A capture taken beyond the router won't contain this segment's ARP at all.

3. Find addresses claimed by more than one MAC

Wireshark already checks for this and marks the packets with an expert warning. Filter for them:

arp.duplicate-address-detected

To list every IP address that more than one MAC claimed, across replies and announcements:

tshark -r capture.pcapng -Y "arp.opcode == 2 || arp.isgratuitous" \
  -T fields -e arp.src.proto_ipv4 -e arp.src.hw_mac \
  | sort -u | awk '{ print $1 }' | uniq -d

On a test capture with a spoofed gateway, both methods pointed at the same address: Wireshark flagged every one of the 30 forged replies, and the list contained only 192.168.1.1.

4. Read the reply pattern

Count replies per sender to see who is answering for which address:

tshark -r capture.pcapng -Y "arp.opcode == 2" \
  -T fields -e arp.src.hw_mac -e arp.src.proto_ipv4 | sort | uniq -c | sort -rn

     30 de:ad:be:ef:00:66	192.168.1.1
      6 00:11:22:33:44:01	192.168.1.1

The real gateway answered six genuine requests. The other MAC sent 30 replies that nobody asked for, five to each of six hosts, every two seconds. Signs of spoofing:

• Unsolicited replies at a steady rhythm, with no request just before them.
• The gateway's address, or another important server's, as the target. Spoofing a printer is rarely the point.
• An unexpected vendor. The first half of a MAC address names the manufacturer, and Wireshark shows it (eth.src resolves to names such as Dell_...). A laptop vendor answering for a router is suspicious.

Confirm the gateway's real MAC from a trusted source, such as the router's own interface or your network documentation. Then find the other MAC in the switch's MAC address table: that tells you which port, and so which device.

5. Rule out legitimate causes

• Gateway redundancy. VRRP and HSRP move a virtual address between routers. VRRP uses virtual MACs beginning 00:00:5e:00:01, and HSRP version 1 00:00:0c:07:ac. A failover changes the answer once, rather than flipping back and forth.
• Virtualisation and teaming. A virtual machine that migrated, or a server with bonded network cards, can legitimately appear with a new MAC.
• Replaced hardware. A new network card, a laptop moving between dock and Wi-Fi, or an address reassigned by DHCP.
• Proxy ARP. A router configured to answer for other subnets answers for many addresses with its own MAC.
• Address probes. Devices joining the network probe from 0.0.0.0. That isn't a claim on any address.

6. Spot ARP floods and scans

A host sending hundreds of requests is usually scanning its subnet for live hosts, as discovery tools do; switch-flooding attacks look similar. Count requests per sender:

tshark -r capture.pcapng -Y "arp.opcode == 1" -T fields -e eth.src | sort | uniq -c | sort -rn | head

Wireshark also raises arp.packet-storm-detected when requests arrive faster than its threshold. Then check whether the sender runs an approved inventory or monitoring tool.

Manual method vs PCAPNG Analyzer