ARP spoof signal
Reads the computer's ARP table (which hardware address each local address belongs to) before and after a 20-second window and compares the router's row. Laptop tool only: a phone is not allowed to read this table.
What it finds
- The router's hardware address changing while the check ran
- Two different local addresses claiming one hardware address
What it cannot find
- A spoof that starts after the check ends
- A spoofer that copies the router's address exactly
- Normal setups where one device has several addresses
- Anything on a phone: Android does not let apps read this table