saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 00:23:15 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/detecting-arp-poisoning-in-network-traffic/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

1.7 KiB
Raw Blame History

ARP Poisoning Detection — API Reference

Libraries

Library Install Purpose
scapy pip install scapy PCAP parsing and ARP packet analysis

Scapy ARP Packet Fields

Field Description
op Operation: 1=request, 2=reply
hwsrc Source MAC address
psrc Source IP address
hwdst Destination MAC address
pdst Destination IP address

ARP Spoofing Indicators

Indicator Description Severity
Duplicate MACs for IP Same IP mapped to multiple MACs CRITICAL
MAC claiming many IPs One MAC responding for 3+ IPs HIGH
Gratuitous ARP flood Excessive unsolicited ARP replies MEDIUM
ARP flip-flop IP/MAC mapping changes rapidly HIGH

Scapy PCAP Analysis

from scapy.all import rdpcap, ARP
packets = rdpcap("capture.pcap")
arp_replies = [p for p in packets if ARP in p and p[ARP].op == 2]

System ARP Table

arp -a                  # Display ARP table
arp -d <ip>            # Delete ARP entry
ip neigh show          # Linux: show neighbor table

arpwatch Database Format

<mac>\t<ip>\t<timestamp>\t<hostname>

Detection Tools

Tool Description
arpwatch Monitors ARP table changes, emails on flip-flop
arpsnitch Real-time ARP spoofing alert
XArp Advanced ARP spoofing detection
Snort rule alert arp any any -> any any (msg:"ARP spoof"; ...)

External References