How can you detect ARP spoofing or inconsistent ARP behavior?

• A. Look for conflicting ARP replies or multiple MAC addresses mapped to the same IP; Wireshark ARP entries reveal inconsistencies.
• B. Filter by http.response.code >= 400.
• C. Inspect TLS ServerKeyExchange messages.
• D. Export HTTP objects.

Answer: (A)

ARP spoofing relies on ARP’s lack of authentication. When someone on the local network falsely maps an IP to their own MAC, other devices update their ARP caches with that incorrect association, redirecting traffic. The clearest signs in a capture are conflicting ARP information: the same IP address appears to be claimed by more than one MAC, or you see ARP replies for an IP from different MAC addresses over a short period. In Wireshark, filtering for ARP traffic and watching the ARP entries makes these inconsistencies visible, such as an IP suddenly mapping to a new MAC or ARP replies arriving without a prior request. Those patterns point to ARP spoofing or inconsistent ARP behavior. The other options relate to HTTP or TLS data and do not reveal ARP-level issues.