Look for ARP replies that were not preceded by ARP requests (gratuitous ARP). - Look for multiple IP addresses being mapped to the same MAC address. - Filter: `arp.opcode == 2` (ARP replies)