Skip to main content
protocols.pageprotocols.page
security

ARP Poisoning

ARP poisoning (ARP spoofing) sends forged ARP replies on a local network to associate the attacker's MAC address with another host's IP. This redirects traffic intended for the victim (usually the gateway) through the attacker, enabling man-in-the-middle attacks. Defense: Dynamic ARP Inspection (DAI) on managed switches.

Definition

ARP poisoning exploits the stateless, unauthenticated nature of ARP. Any host can send gratuitous ARP replies claiming 'IP 192.168.1.1 is at MAC AA:BB:CC:DD:EE:FF' without being asked. Other hosts update their ARP cache with this false mapping. By claiming to be the default gateway, the attacker receives all traffic from victim machines, inspects or modifies it, and forwards it to the real gateway (transparently). Combined with SSL-stripping (downgrading HTTPS to HTTP), ARP poisoning enables full credential capture on local networks. Defenses: Dynamic ARP Inspection (DAI) on managed switches validates ARP packets against the DHCP snooping binding table. Static ARP entries on critical hosts (arp -s gateway_ip gateway_mac). 802.1X port authentication prevents unauthorized hosts from joining the network at all.

Examples

  • –arpspoof -i eth0 -t victim_ip gateway_ip (redirects victim's traffic)
  • –arp -s 192.168.1.1 AA:BB:CC:DD:EE:FF (static ARP entry – immune to spoofing)
  • –ip arp inspection vlan 10 (Cisco DAI – validates ARP on managed switches)

Related Protocols

ip

Related Terms

ARP (Address Resolution Protocol)

ARP resolves IP addresses to MAC addresses on local networks. When a host needs to send a packet to an IP on the same subnet, it broadcasts an ARP request. The target responds with its MAC address. ARP has no authentication – ARP spoofing enables man-in-the-middle attacks on LANs.

Man-in-the-Middle (MITM)

A man-in-the-middle attack intercepts communication between two parties, reading or modifying traffic without either party's knowledge. TLS prevents MITM by authenticating the server via certificates and encrypting the channel. MITM succeeds when: TLS is absent (HTTP), certificate validation is disabled, or the attacker controls a trusted CA.

DNS Spoofing

DNS spoofing injects forged DNS responses to redirect victims to attacker-controlled servers. Cache poisoning targets recursive resolvers – a single poisoned cache entry redirects all clients using that resolver. DNSSEC cryptographically signs DNS records to prevent spoofing. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt queries.