| Event | Description | Severity | Threshold | Possible causes and solutions |
| ARP Too Many Unrequested Response | The percentage of unrequested ARP response of a physical node is equal to or higher than the Unrequested Responses threshold. | Warning | Unrequested Responses - 50% | Check the source and target physical node for possible ARP spoofing. |
| ARP Request Storm | The number of ARP request packets per second exceeds the ARP requests/sec threshold, indicating that an ARP request storm has been detected. | Warning |
Sample Time - second
ARP requests/sec - 10
| Check the source station for the application that sent the ARP requests. |
| ARP Scan | A station is scanning the network address via ARP requests. | Warning | | Check the source station for the application that performs the scanning. |