Built off the open source project Osquery
Description: Looks for ARP anomalies from the host's side.
What The Data Shows: Shows all ARP entries as well as the total entries on a host.
SELECT address, mac, COUNT(mac) AS mac_count FROM arp_cache WHERE mac NOT LIKE '01:00:5E%' AND mac NOT LIKE 'ff:ff:ff%'GROUP BY mac HAVING count(mac) > 1;
@mjomha what about filtering our multicast IPs and/or broadcast MACs?
Good idea. Let me give that a go and update the query. I was filtering within the Live Ops Gui, let me try adding that to the query.
Updated the query now it filters out broadcast and multicast addresses.
@mjomha you left off the HAVING count(mac) > 1 from your original query. Was this on purpose?
Thanks Jneslon for noticing. Accidentally deleted the last line.