Simple detecting of ARP spoofing

arp_watch.py

from scapy.all import sniff, ARP
import sys

arp_table = {}

def watch_arp(packet):
    if packet[ARP].op == 2:
        if arp_table.get(packet[ARP].psrc) == None:
            print ("Register new device %s:%s"%(packet[ARP].hwsrc,packet[ARP].psrc))
            arp_table[packet[ARP].psrc] = packet[ARP].hwsrc
        elif arp_table.get(packet[ARP].psrc) and arp_table[packet[ARP].psrc] != packet[ARP].hwsrc:
            print("Detected spoofing, %s change his IP from %s to %s"%(packet[ARP].hwsrc, arp_table[packet[ARP].psrc],packet[ARP].psrc))
            arp_table[packet[ARP].psrc] = packet[ARP].hwsrc

print("Starting monitor..")
# for choosing interface to sniff set: iface="iface_name"
sniff(prn=watch_arp,filter="arp",store=0)