Editing ARP spoofing (section)

===Detection and prevention software===
Software that detects ARP spoofing generally relies on some form of certification or cross-checking of ARP responses. Uncertified ARP responses are then blocked. These techniques may be integrated with the [[DHCP server]] so that both [[Dynamic IP|dynamic]] and [[static IP]] addresses are certified. This capability may be implemented in individual hosts or may be integrated into [[Ethernet switch]]es or other network equipment. The existence of multiple IP addresses associated with a single MAC address may indicate an ARP spoof attack, although there are legitimate uses of such a configuration. In a more passive approach, a device listens for ARP replies on a network, and sends a notification via [[email]] when an ARP entry changes.<ref>{{cite web |url=https://www.researchgate.net/publication/282568321 |title=A Security Approach to Prevent ARP Poisoning and Defensive tools |website=ResearchGate|language=en|access-date=2019-03-22 |archive-date=2019-05-03|archive-url=https://web.archive.org/web/20190503221834/https://www.researchgate.net/publication/282568321_A_Security_Approach_to_Prevent_ARP_Poisoning_and_Defensive_tools|url-status=live}}</ref>

AntiARP<ref>[http://www.antiarp.com/english.html AntiARP] {{webarchive |url=https://web.archive.org/web/20110606051646/http://www.antiarp.com/english.html |date=June 6, 2011 }}</ref> also provides Windows-based spoofing prevention at the kernel level. ArpStar is a Linux module for kernel 2.6 and Linksys routers that drops invalid packets that violate mapping, and contains an option to repoison or heal.

Some virtualized environments such as [[Kernel-based Virtual Machine|KVM]] also provide security mechanisms to prevent MAC spoofing between guests running on the same host.<ref>{{cite web |url=https://www.berrange.com/posts/2011/10/03/guest-mac-spoofing-denial-of-service-and-preventing-it-with-libvirt-and-kvm/ |title=Daniel P. Berrangé » Blog Archive » Guest MAC spoofing denial of service and preventing it with libvirt and KVM |access-date=2019-08-09 |archive-date=2019-08-09 |archive-url=https://web.archive.org/web/20190809113318/https://www.berrange.com/posts/2011/10/03/guest-mac-spoofing-denial-of-service-and-preventing-it-with-libvirt-and-kvm/ |url-status=live }}</ref>

Additionally some Ethernet adapters provide MAC and VLAN anti-spoofing features.<ref>{{cite web |url=https://downloadmirror.intel.com/26556/eng/README.txt |title=Archived copy |access-date=2019-08-09 |archive-date=2019-09-03 |archive-url=https://web.archive.org/web/20190903084638/https://downloadmirror.intel.com/26556/eng/README.txt |url-status=live }}</ref>

[[OpenBSD]] watches passively for hosts impersonating the local host and notifies in case of any attempt to overwrite a permanent entry.<ref>{{cite web |url=https://man.openbsd.org/arp.4 |title=Arp(4) - OpenBSD manual pages |access-date=2019-08-09 |archive-date=2019-08-09 |archive-url=https://web.archive.org/web/20190809120053/https://man.openbsd.org/arp.4 |url-status=live }}</ref>