Install arpoison with Homebrew, Nix

Project links

• Homepage
• Package manager page

Commands and aliases

• arpoison

Project history

The official upstream surface is old-school: a static homepage, a tarball, a dependency note for libnet, and contact information. The 0.7 archive includes source, a README, a Makefile, a GPL license file, and an arpoison.8 manual page dated January 2003. No official HTTP source-control repository was found on the project homepage.

arpoison belongs to the early-2000s packet-construction utility era, when small C programs built on libnet were common tools for network labs and security testing. Its source and manual are focused on one task: generating custom ARP traffic rather than providing a broader scanning, discovery, or intrusion framework.

Adoption history

arpoison's adoption is necessarily narrow. It is useful to administrators, students, and security testers who need controlled ARP cache manipulation on a local network, but it is not a general-purpose network inventory tool or a modern maintained platform.

The package's continued value is mostly archival and practical: when a user needs a tiny utility that emits hand-crafted ARP packets, the package manager can still provide it without requiring a checkout from a live development project.

How it is used

The bundled README says the program sends a custom ARP reply packet with chosen hardware and protocol address information, relying on ARP's stateless behavior. The manual page documents options for interface, destination IP, source IP, target MAC, source MAC, ARP request mode, packet count, and delay between packets.

In practice, arpoison is used for controlled ARP cache updates and ARP poisoning experiments on local networks. Because it sends forged link-layer traffic, it is a privileged and security-sensitive command rather than a normal user productivity tool.

Why package nerds care

arpoison is significant mostly as a compact preservation package: one executable, one C source tree, one man page, and an official tarball. It is the sort of security utility where a package database should preserve the real upstream homepage and avoid promoting unrelated mirrors as official repositories.

Its metadata is also a reminder that old security tools often predate today's expectation of GitHub, release feeds, CI, and signed source releases. For this package, the conservative answer is source-backed history plus a null repository.

Timeline

• 2003-01: The bundled manual page is dated January 2003.
• 0.7: The official homepage distributes arpoison-0.7.tar.gz.

Related projects

• libnet is the packet-construction library required by the official homepage and README.
• arping and arp-scan live in the same ARP-tool neighborhood, but arpoison is specifically about crafted ARP cache update packets.

Sources

• http://www.arpoison.net/
• http://www.arpoison.net/arpoison-0.7.tar.gz