# Install arpoison with Homebrew, Nix

UNIX arp cache update utility. Version 0.7 via Homebrew; verified from local package data. Also installable with nix: nix profile install nixpkgs#arpoison.

## Install

```sh
sudo av install brew:arpoison
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install arpoison
```

  Evidence: local Homebrew formula metadata

### Linux

- Nix (92%):

```sh
nix profile install nixpkgs#arpoison
```

  Evidence: nixpkgs package indexes: pkgs/by-name/ar/arpoison/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

## Package facts

- **Package key:** brew:arpoison
- **Package manager:** Homebrew
- **Version:** 0.7
- **Source summary:** UNIX arp cache update utility
- **Homepage:** <http://www.arpoison.net/>
- **Generated:** 2026-08-03T19:37:03+00:00

## Executables

- arpoison (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 0.7
## Project history and usage

arpoison is Steve Buer's small Unix ARP cache update utility. Its official site describes it tersely as a Unix ARP cache update utility and distributes a 0.7 source archive; the bundled manual page describes a command that constructs ARP request or reply packets with user-specified hardware and protocol addresses.

### Project history

The official upstream surface is old-school: a static homepage, a tarball, a dependency note for libnet, and contact information. The 0.7 archive includes source, a README, a Makefile, a GPL license file, and an arpoison.8 manual page dated January 2003. No official HTTP source-control repository was found on the project homepage.

arpoison belongs to the early-2000s packet-construction utility era, when small C programs built on libnet were common tools for network labs and security testing. Its source and manual are focused on one task: generating custom ARP traffic rather than providing a broader scanning, discovery, or intrusion framework.

### Adoption history

arpoison's adoption is necessarily narrow. It is useful to administrators, students, and security testers who need controlled ARP cache manipulation on a local network, but it is not a general-purpose network inventory tool or a modern maintained platform.

The package's continued value is mostly archival and practical: when a user needs a tiny utility that emits hand-crafted ARP packets, the package manager can still provide it without requiring a checkout from a live development project.

### How it is used

The bundled README says the program sends a custom ARP reply packet with chosen hardware and protocol address information, relying on ARP's stateless behavior. The manual page documents options for interface, destination IP, source IP, target MAC, source MAC, ARP request mode, packet count, and delay between packets.

In practice, arpoison is used for controlled ARP cache updates and ARP poisoning experiments on local networks. Because it sends forged link-layer traffic, it is a privileged and security-sensitive command rather than a normal user productivity tool.

### Why package nerds care

arpoison is significant mostly as a compact preservation package: one executable, one C source tree, one man page, and an official tarball. It is the sort of security utility where a package database should preserve the real upstream homepage and avoid promoting unrelated mirrors as official repositories.

Its metadata is also a reminder that old security tools often predate today's expectation of GitHub, release feeds, CI, and signed source releases. For this package, the conservative answer is source-backed history plus a null repository.

### Timeline

- 2003-01: The bundled manual page is dated January 2003.
- 0.7: The official homepage distributes arpoison-0.7.tar.gz.

### Related projects

- libnet is the packet-construction library required by the official homepage and README.
- arping and arp-scan live in the same ARP-tool neighborhood, but arpoison is specifically about crafted ARP cache update packets.

### Sources

- <http://www.arpoison.net/>
- <http://www.arpoison.net/arpoison-0.7.tar.gz>


## Security Notes

narrow executable package without higher-risk signals.

- **Geiger risk:** green / low
- narrow executable package without higher-risk signals

## Other Package-Manager Records

- Nix - arpoison: normalized package name match | nixpkgs package indexes: pkgs/by-name/ar/arpoison/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/arpoison.yml](https://github.com/mxcl/pkgdb/blob/main/combined/arpoison.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph