ARP Cache Poisoning - Duplicate IP Response

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects ARP cache poisoning attempts by identifying multiple ARP responses (opcode 2) for the same IP address within a short time frame (15 responses in 5 seconds from the same source). This behavior is indicative of an attacker attempting to redirect network traffic by sending forged ARP replies.