i'm trying to understand more advancedly on how we can prevent an ip spoofing . since its impossible to know the original mac adress of a spoofed retour how we can check for example if the packets we sent or we received are going/coming from the retour (192.168.0.1) ? .
for example is it safe to determine that the seconde call of an Arp request is fake ? because it makes no sense after the first arp request the retour have its table set up and ready to go why will it sent more arp requests every time ?
if not , most of time a the source IP does not belongs to the spoofer his self so we cannot ping , is it safe to determine that its a fake packet ?
and if we can ping the source ip its source hostname is up and running how we can find out that the packet being sent or received is fake ?
I'm trying to understand more about spoofing i might have some missunderstanding of some concepts so excuse me for any confusing terms !