No matter how much I google I can't get a definitive answer.
Static ARP entries:
Static ARP addresses prevent only simple attacks and do not scale on a large network, since the mapping has to be set for each pair of machines resulting in n^2-n ARP entries that have to be configured when n machines are present: On every machine there must be an ARP entry for every other machine on the network, which are n-1 ARP entries on each of the n machines. While static entries provide some security against spoofing if the operating system handles them correctly, they result in maintenance efforts as address mappings of all systems in the network have to be distributed.
ARP detection software:
This method is pretty useless. There are very few ARP detection programs out there, and the few that do exist are either free junk or over priced. In addition, to use these programs on a windows machine requires installing special drivers for your wireless cards. Recommendation: Don’t use. http://lewiscomputerhowto.blogspot.com/2014/03/perform-man-in-middle-attack-with-kali.html
So if neither anti-ARP software nor Static ARP entries work then how do you protect against ARP spoofing in a big network?