ARP spoofing is a serious problem for network security. It allows hackers to trick a network by linking their own MAC address to a real device’s IP address. This lets them steal, change, or block network traffic. Hackers can use this to launch attacks like Man in the Middle, session hijacking, and Denial of service. Old methods to detect ARP spoofing, like fixed IP-MAC lists and ICMP checks, do not work well in large or real-time systems. This paper suggests a smart way to find and stop ARP spoofing using Bettercap and Deep Packet Inspection (DPI). Bettercap watches ARP traffic in real time, while DPI carefully checks network packets for unusual activity. Together, these tools quickly and accurately detect ARP spoofing with little impact on network speed. The system keeps an eye on ARP messages, deeply examines packet details, and finds suspicious changes. When it detects an attack, it blocks harmful packets, fixes the ARP table with correct information, and informs network admins.