MultiPacketARPConversations

A single-packet filter can’t catch these. They need a pass through the capture that pairs requests with replies.

• Unanswered request: usually a dead host, or a scan sweeping a subnet (one MAC asking for many IPs in quick succession).
• Unsolicited reply: a reply with no matching request before it. The main signature of ARP spoofing.
• Proxy ARP: one MAC answering for several IPs, typically a router or VPN box answering on behalf of others.
• IP/MAC flip-flop: the same IP claimed by different MACs over time. Could be a real conflict, DHCP reassignment, failover, or spoofing.
• Simultaneous probes: two MACs probing the same IP within a few seconds. That’s also a conflict under the standard.