ARP Spoof Detector false positive

[gordol]

FAO: (@tuannvm)

the following is output from arp -a

? (239.255.255.250) at 1:0:5e:7f:ff:fa on en5 ifscope permanent [ethernet]
? (239.255.255.250) at 1:0:5e:7f:ff:fa on en6 ifscope permanent [ethernet]

see the problem?

your code does not check the interfaces in the arp table, just the addresses, so it's reporting false positive if you have multiple interfaces, and, in this case, are using chrome browser (ssdp)