Which tool is a UNIX program used to listen to ARP replies?

Which tool is a UNIX program used to listen to ARP replies?

• A. Nmap
• B. Wireshark
• C. Snort
• D. ARPWatch

Answer: (D)

This item tests recognizing a UNIX utility dedicated to watching ARP activity. ARPWatch runs on UNIX and passively monitors ARP traffic, keeping a live table of IP-to-MAC mappings and alerting when an entry changes or unusual ARP activity is detected. That focus on listening to ARP messages and tracking mappings makes it the natural choice for listening to ARP replies. Nmap is a network scanner that may use ARP in some scans, but it isn’t a continuous ARP listener. Wireshark is a general-purpose packet analyzer capable of capturing ARP packets, including ARP replies, but it isn’t a UNIX-specific program dedicated to ARP monitoring. Snort is an intrusion detection system that analyzes traffic for patterns, not a tool focused on ARP reply monitoring.

This item tests recognizing a UNIX utility dedicated to watching ARP activity. ARPWatch runs on UNIX and passively monitors ARP traffic, keeping a live table of IP-to-MAC mappings and alerting when an entry changes or unusual ARP activity is detected. That focus on listening to ARP messages and tracking mappings makes it the natural choice for listening to ARP replies.

Nmap is a network scanner that may use ARP in some scans, but it isn’t a continuous ARP listener. Wireshark is a general-purpose packet analyzer capable of capturing ARP packets, including ARP replies, but it isn’t a UNIX-specific program dedicated to ARP monitoring. Snort is an intrusion detection system that analyzes traffic for patterns, not a tool focused on ARP reply monitoring.