Yeah, I get they mixed up how arp works.. For requests on the same L2, and just TCP replies. When you connect to another network you'll never send/receive arps..
> That’s where our solution comes in — a solution designed specifically for internal networks, one that doesn’t just defend but creates chaos for attackers.
It’s just usually tremendously impractical to extend the tar pit to all your layer 2 domains in many modern network architectures, so while this is interesting, it’s unlikely to see production use.