ESET can detect ARP Poisoning based from my experience, I can't find my screenshot to prove it. ARP spoofing can also be done when the attacker is already connected to the network and I think there are cases also that neighbor discovery protocol (IPV6), which is ARP in IPV4 that are used to accomplish a man in the middle attack.