If you look at the packet, there is absolutely no difference in the format of a spoofed ARP reply and a real ARP reply: they look identical.
What makes a real ARP reply real? It came from the computer which legitimately has the queried IP address.
What makes a fake ARP reply fake? It came from a different computer than the one which really has that IP address.
Additionally there might be proxy ARP servers, although these are rather uncommon. These reply to ARP on behalf of the computer with the IP address, but are legitimate in that they are set up for this purpose by the network adminstrators.
As you can see, the only difference is whether they are legitimate or not.
If you monitor ARP on a network, it can be very hard to differentiate between
- a computer changing its network card: a given IP address reponds to ARP with one MAC address and then a different one
- an IP address being given from one computer to another by DHCP lease change or manual reconfiguration
- two proxy ARP servers
- ARP spoof replies
You'll need extra information in order to know which is which.