Editing ARP spoofing (section)

==Tools==

===Defense===
{| style="text-align: center;" class="wikitable sortable"
|- style="background: #ececec;"
! Name
! OS
! GUI
! Free
! Protection
! Per interface
! Active/passive
! Notes
|-
| Agnitum Outpost Firewall
| Windows || {{yes}} || {{no}} || {{yes}} || {{no}} || passive ||
|- 
| AntiARP
| Windows || {{yes}} ||{{no}} ||{{yes}}||{{no}}|| active+passive ||
|-
| Antidote<ref>{{cite web |url=http://antidote.sourceforge.net/ |title=Antidote |access-date=2014-04-07 |archive-date=2012-03-13 |archive-url=https://web.archive.org/web/20120313121350/http://antidote.sourceforge.net/ |url-status=live }}</ref> 
| Linux || {{no}} || {{yes}} || {{no}} || {{dunno}} || passive || Linux daemon, monitors mappings, unusually large number of ARP packets.
|-
| Arp_Antidote<ref>{{cite web |url=http://burbon04.gmxhome.de/linux/ARPSpoofing.html |title=Arp_Antidote |access-date=2011-08-02 |archive-date=2012-01-14 |archive-url=https://web.archive.org/web/20120114185136/http://burbon04.gmxhome.de/linux/ARPSpoofing.html |url-status=dead }}</ref>
| Linux || {{no}} || {{yes}} || {{no}} || {{dunno}} || passive || Linux Kernel Patch for 2.4.18 – 2.4.20, watches mappings, can define action to take when.
|-
| Arpalert
| Linux || {{no}} ||{{yes}}||{{no}}||{{yes}}||passive || Predefined list of allowed MAC addresses, alert if MAC that is not in list.
|-
| [[ArpON]]
| Linux||{{no}} ||{{yes}}||{{yes}}|| {{yes}} || active+passive || Portable handler daemon for securing ARP against spoofing, cache poisoning or poison routing attacks in static, dynamic and hybrid networks.
|-
| [[ArpGuard]]
| Mac||{{yes}} ||{{no}}||{{yes}}|| {{yes}} || active+passive ||
|-
| ArpStar
| Linux ||{{no}} ||{{yes}}||{{yes}}||{{dunno}}||passive ||
|-
|[[Arpwatch]]
| Linux ||{{no}} ||{{yes}}||{{no}}||{{yes}}||passive || Keep mappings of IP-MAC pairs, report changes via Syslog, Email.
|-
| ArpwatchNG
| Linux||{{no}} ||{{yes}}||{{no}}||{{no}}||passive || Keep mappings of IP-MAC pairs, report changes via Syslog, Email.
|-
| Colasoft [[Capsa (software)|Capsa]]
| Windows||{{yes}} ||{{no}}||{{no}}||{{yes}}|| no detection, only analysis with manual inspection ||
|-
| cSploit<ref name=csploit>{{cite web |url=http://www.csploit.org/ |title=cSploit |publisher=tux_mind |access-date=2015-10-17 |archive-date=2019-03-12 |archive-url=https://web.archive.org/web/20190312042507/http://www.csploit.org/ |url-status=live }}</ref>
| Android (rooted only)|| {{yes}} || {{yes}} ||{{no}}||{{yes}}||passive ||
|-
| elmoCut<ref name=elmocut>{{cite web|url=https://github.com/elmoiv/elmocut |title=elmoCut: EyeCandy ARP Spoofer (GitHub Home Page)|website=[[GitHub]] }}</ref> || Windows || {{yes}} || {{yes}} || {{no}} || {{dunno}} || passive || EyeCandy ARP spoofer for Windows
|-
| Prelude IDS
| {{dunno}}||{{dunno}} ||{{dunno}}||{{dunno}}||{{dunno}}||{{dunno}} || ArpSpoof plugin, basic checks on addresses.
|-
|Panda Security
| Windows ||{{dunno}} ||{{dunno}} ||{{yes}} ||{{dunno}} || Active || Performs basic checks on addresses
|-
| remarp
| Linux||{{no}} ||{{yes}}||{{no}}||{{no}}||passive ||
|-
|[[Snort (software)|Snort]]
| Windows/Linux||{{no}} ||{{yes}}||{{no}}||{{yes}}||passive || Snort preprocessor Arpspoof, performs basic checks on addresses
|-
| Winarpwatch
| Windows || {{no}} || {{yes}} ||{{no}}||{{no}}||passive || Keep mappings of IP-MAC pairs, report changes via Syslog, Email.
|-
| XArp<ref name="XArp">{{cite web |url=http://www.xarp.net/ |title=XArp |access-date=2021-01-23 |archive-date=2020-06-16 |archive-url=https://web.archive.org/web/20200616221850/http://www.xarp.net/ |url-status=live }}</ref>
| Windows, Linux || {{yes}} || {{yes}} (+pro version) ||{{yes}} (Linux, pro)||{{yes}}|| active + passive || Advanced ARP spoofing detection, active probing and passive checks. Two user interfaces: normal view with predefined security levels, pro view with per-interface configuration of detection modules and active validation. Windows and Linux, GUI-based.
|-
| Seconfig XP
| Windows 2000/XP/2003 only || {{yes}} || {{yes}} ||{{yes}}||{{no}}||only activates protection built-in some versions of Windows ||
|-
| zANTI
| Android (rooted only) || {{yes}} || {{yes}} ||{{no}}||{{dunno}}||passive ||
|-
| NetSec Framework
| Linux || {{no}} || {{yes}} ||{{no}}||{{no}}||active ||
|-
|anti-arpspoof<ref>{{usurped|1=[https://web.archive.org/web/20080831003151/http://sync-io.net/Sec/anti-arpspoof.aspx anti-arpspoof]}}</ref>
| Windows || {{yes}} || {{yes}} || {{dunno}} || {{dunno}} || {{dunno}} || 
|-
|DefendARP:<ref>{{cite web |url=http://arppoisoning.com/defense-scripts/ |title=Defense Scripts {{!}} ARP Poisoning<!-- Bot generated title --> |access-date=2013-06-08 |archive-date=2013-01-22 |archive-url=https://web.archive.org/web/20130122062207/http://arppoisoning.com/defense-scripts/ |url-status=live }}</ref> 
| {{dunno}} || {{dunno}} || {{dunno}} || {{dunno}} || {{dunno}} || {{dunno}} || A host-based ARP table monitoring and defense tool designed for use when connecting to public wifi. DefendARP detects ARP poisoning attacks, corrects the poisoned entry, and identifies the MAC and IP address of the attacker.
|-
| NetCutDefender:<ref>{{cite web |url=http://www.arcai.com/netcut-defender/ |title=Netcut defender &#124; Arcai.com |access-date=2018-02-07 |archive-date=2019-04-08 |archive-url=https://web.archive.org/web/20190408110511/http://arcai.com/netcut-defender/ |url-status=live }}</ref> 
| Windows || {{dunno}} || {{dunno}} || {{dunno}} || {{dunno}} || {{dunno}} || GUI for Windows that can protect from ARP attacks
|}

===Spoofing===
Some of the tools that can be used to carry out ARP spoofing attacks:
<!-- please NOTABLE tools only (i.e., with Wikipedia articles), DO NOT use as a general repository, see [[WP:EL]] & [[WP:LINKFARM]], NO red links -->

*[[Dsniff]]
*[[Ettercap (computing)|Ettercap]]
*[[arping]]<ref name=l0t3k>{{cite web|url=http://www.l0t3k.org/security/tools/arp/ |title=ARP Vulnerabilities: The Complete Documentation |publisher=l0T3K |access-date=2011-05-03 |url-status=dead |archive-url=https://web.archive.org/web/20110305160956/http://www.l0t3k.org/security/tools/arp/ |archive-date=2011-03-05 }}</ref>
*[[Cain and Abel (software)|Cain and Abel]]