Can a user spot ARP poisoning?<p>How about static ARP entries and taking note when any hostname-to-ether-address mapping changes?<p>ARP monitoring with BSD<p><pre><code> arp -s hostname ether_addr
</code></pre>
Then<p><pre><code> [ -f arp.dat ]||>arp.dat
arpwatch -df arp.dat
</code></pre>
Or what if the user disables ARP on the interface? Assuming driver was named "eth" as in GNU/Linux:<p><pre><code> ifconfig eth0 -arp</code></pre>