Defender Checks on YOUR Table

A baseline is a dated pair: default-gateway IP plus the MAC THIS host currently maps to it, recorded when you have no reason to suspect a lie. The sticker on an AP you own, or the admin page of a lab router you own after a GATE that was not “Router Admin” for the course demo, can corroborate. A café you do not administer cannot.

Save that pair in cyberlium-lab, not in a public gist. Tomorrow's comparison is only possible if today's file exists.

sudo apt install dnsutils

arp -a > "$HOME/cyberlium-lab/t11-m06-arp-snapshot.txt"
powershell.exe -NoProfile -Command "Get-NetNeighbor | Format-Table IPAddress,LinkLayerAddress,State -AutoSize" > "$HOME/cyberlium-lab/t11-m06-neigh-snapshot.txt" 2>$null || ip neigh show > "$HOME/cyberlium-lab/t11-m06-neigh-snapshot.txt"

When you suspect a change, you re-read THIS host's table and diff it against the snapshot. A new phone on the LAN may add rows. The row that deserves a raised eyebrow is the gateway IP pointing at a new MAC without a router swap you know about.

Flapping between two MACs for the same gateway IP is also a signal on a network you own. The response is still documentation and isolation — not a counter-spoof.

sudo apt install python3

brew install python3

python3 - << 'PY'
from pathlib import Path
home = Path.home() / "cyberlium-lab"
a = home / "t11-m06-neigh-snapshot.txt"
b = home / "t11-m06-neigh-live.txt"
print("snapshot_exists", a.is_file(), "bytes", a.stat().st_size if a.is_file() else 0)
print("write a new live dump in the lab lesson before expecting a diff")
if a.is_file() and b.is_file() and a.read_text(errors="replace") != b.read_text(errors="replace"):
  print("files differ — inspect the GATEWAY row, do not arpspoof")
else:
  print("no live dump yet or files match — still do not scan the /24")
PY

You will not nmap the subnet to “see whose MAC is extra.” You will not hydra a gateway because a row looks odd. You will not bind a sniffer helper to 0.0.0.0 on café Wi-Fi. Those moves convert literacy into an incident you caused.

If DEMO was a router login, you already STOPPED touching that box. Defender checks in this course stay on the computer in front of you.

sudo apt install nmap
sudo apt install python3
sudo apt install dnsutils

brew install nmap
brew install python3

choco install nmap  # or download https://nmap.org/download.html

python3 - << 'PY'
import socket
s = socket.socket(); s.settimeout(0.4)
r = s.connect_ex(("127.0.0.1", 8785)); s.close()
print("127.0.0.1:8785", "open_or_listen" if r == 0 else f"not_up({r})")
PY

Snapshot arp/neighbor output under cyberlium-lab, chmod 600. Know which row is the default via. Diff files later. Never poison “to verify.” Never nmap the LAN.

Snapshot paths t11-m06-arp-snapshot.txt / t11-m06-neigh-snapshot.txt. DEMO identified/STOP. SAFE Next lab re-reads the live table.