ARP Poisoning on Wireless Network Segment

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects Address Resolution Protocol (ARP) poisoning attempts on a network segment, specifically looking for ARP reply packets (opcode 2). It uses a thresholding mechanism to trigger an alert if 10 such packets are observed from the same source within a 5-second window, indicating a potential malicious ARP spoofing activity.