Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scripts that flag gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-arp-poisoning-in-network-trafficnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-arp-poisoning-in-network-traffic -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-arp-poisoning-in-network-traffic -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-arp-poisoning-in-network-trafficgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-arp-poisoning-in-network-trafficgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-arp-poisoning-in-network-traffic ~/.claude/skills/detecting-arp-poisoning-in-network-traffic # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-arp-poisoning-in-network-traffic ~/.agents/skills/detecting-arp-poisoning-in-network-traffic # Codex, Cursor, Gemini CLI, Copilot, OpenCode