from collections import Counter, defaultdict
from scapy.layers.l2 import ARP


def extract_arp_activity(packets):
    requests = Counter()
    replies = Counter()
    ip_mac = defaultdict(set)

    for pkt in packets:
        if pkt.haslayer(ARP):
            arp = pkt[ARP]
            if arp.op == 1:
                requests[arp.pdst] += 1
            elif arp.op == 2:
                replies[arp.psrc] += 1
                ip_mac[arp.psrc].add(arp.hwsrc)

    duplicate_ips = {ip: list(macs) for ip, macs in ip_mac.items() if len(macs) > 1}

    return {
        "requests": dict(requests),
        "replies": dict(replies),
        "duplicate_ips": duplicate_ips,
    }
