Build an ARP Toolkit — Attack and Detection in C

I spend a lot of time looking at alerts that say "possible MITM activity" or "ARP anomaly detected." They show up in the SIEM, get triaged, and usually turn out to be benign — a NIC failover, a miscon