Which tool can be used to monitor strange ARP activity?

• A. ARPwatch
• B. Wireshark
• C. Nmap
• D. Snort

Answer: (A)

Monitoring ARP activity on a LAN relies on continuously observing ARP frames and tracking which MAC address is associated with each IP. ARPwatch does exactly that: it passively monitors ARP traffic, maintains a table of IP-to-MAC bindings, and raises alerts when a known IP suddenly appears with a different MAC or when there’s a potential IP conflict. This makes it particularly effective for spotting ARP spoofing, poisoning attempts, or misconfigurations.

Wireshark can show ARP packets and let you inspect them, but it’s a general packet analyzer used for manual troubleshooting rather than ongoing, automatic monitoring across a network. Nmap is a discovery tool for finding devices and services, not a continuous ARP watcher. Snort is an intrusion-detection system that can flag suspicious traffic with rules, but it isn’t specialized to monitor and alert on ARP state changes across an entire LAN.

So, ARPwatch is the best fit for monitoring strange ARP activity.