What is ARP spoofing?

ARP spoofing, also known as ARP poisoning, is a local network attack that exploits the Address Resolution Protocol to redirect traffic through an attacker's machine. It works because ARP has no built-in authentication, so a host will accept and cache a forged reply that maps a trusted IP address, typically the gateway, to the attacker's MAC address. This lets a single host on the local network quietly insert itself between other devices and their gateway.

How does ARP spoofing work?

The attacker sends forged ARP replies to both a victim and the gateway, each falsely claiming that the other's IP address belongs to the attacker's MAC address. Both update their ARP caches, so traffic between them is directed to the attacker, who typically enables IP forwarding to relay it onward and keep connectivity intact. To keep the poisoned entries fresh, the attacker resends the replies periodically as unsolicited gratuitous ARP messages.

How do I detect ARP spoofing?

Detection focuses on inconsistencies in the mapping between IP and MAC addresses, since the attack manipulates ARP caches. Red flags include a gateway IP suddenly resolving to a new MAC, the same MAC address appearing for multiple IPs, or a surge of unsolicited ARP replies. Comparing the live ARP table against a known-good inventory of IP-to-MAC pairs highlights these anomalies.

How do I defend against ARP spoofing?

Because ARP itself cannot be made trustworthy, defenses come from the surrounding infrastructure. Dynamic ARP Inspection on managed switches validates ARP packets against trusted IP-to-MAC-to-port bindings built by DHCP snooping, dropping forged replies before they spread. Static ARP entries for critical systems, network segmentation to limit an attacker's reach, and pervasive authenticated encryption so that poisoning yields little readable data round out the defenses.

Does ARP spoofing break HTTPS or TLS?

No, ARP spoofing grants network position but does not by itself defeat correctly validated TLS, because the attacker cannot present a certificate the victim's system trusts. The confidentiality and integrity of properly encrypted connections still hold even when an attacker sits in the path. The main exposure is unencrypted traffic, or connections where a user can be tricked into accepting an invalid certificate.

⇄ Network Security

ARP Spoofing and Poisoning Explained

Q: Why is ARP vulnerable to spoofing?

ARP is vulnerable because it is stateless and unauthenticated: a host will accept and cache an ARP reply even if it never sent a request, and it has no way to verify that the responder genuinely owns the claimed IP address. The protocol was designed on the assumption that every device on the local network is honest. That built-in trust is the flaw ARP spoofing abuses.

ARP spoofing, also known as ARP poisoning, is a local network attack that exploits the Address Resolution Protocol to redirect traffic through an attacker's machine. It matters because ARP has no built-in authentication, so a single host on a local network can quietly insert itself between other devices and their gateway, enabling interception and manipulation of traffic. Understanding the mechanism explains why it is so effective and what defenses actually stop it.

What ARP Is and Why It Is Trusting

On an IPv4 local network, devices communicate at the data link layer using MAC addresses, but applications and routing work with IP addresses. The Address Resolution Protocol bridges the two: when a host needs to send a packet to an IP address on its local segment, it broadcasts an ARP request asking who has that IP, and the owner replies with its MAC address. The asker caches the answer in its ARP table.

The protocol's fatal flaw is that it is stateless and unauthenticated. A host will accept and cache an ARP reply even if it never sent a request, and it has no way to verify that the responder genuinely owns the claimed IP. This design assumes every device on the local network is honest.

How ARP Spoofing Works

An attacker abuses this trust by sending forged ARP replies that map a legitimate IP address, typically the default gateway, to the attacker's own MAC address. The sequence is straightforward:

The attacker identifies the victim and the gateway on the local segment.
It sends the victim a forged ARP reply claiming the gateway's IP belongs to the attacker's MAC.
It sends the gateway a forged ARP reply claiming the victim's IP belongs to the attacker's MAC.
Both update their ARP caches, and traffic between them is directed to the attacker.

To keep the poisoned entries fresh, the attacker resends these replies periodically, often as unsolicited gratuitous ARP messages. To remain undetected, the attacker enables IP forwarding so that traffic is relayed on to the real destination after inspection, keeping connectivity intact while sitting in the middle.

What Attackers Achieve With ARP Poisoning

Once traffic flows through the attacker, ARP spoofing becomes the foundation for a man-in-the-middle attack. With this position an attacker can:

Capture unencrypted credentials, cookies, and other sensitive data.
Attempt to strip or downgrade encryption on connections that permit it.
Modify content in transit, such as injecting malicious payloads into unencrypted responses.
Selectively drop traffic to cause a denial of service between the two parties.

The impact is bounded by encryption: correctly validated TLS still protects confidentiality and integrity even when an attacker sits in the path, because the attacker cannot present a trusted certificate. ARP spoofing grants position, not an automatic defeat of cryptography.

Detecting ARP Spoofing

Because the attack manipulates ARP caches, detection focuses on inconsistencies in the mapping between IP and MAC addresses:

Duplicate MAC addresses appearing for multiple IPs, or a gateway IP suddenly resolving to a new MAC, are red flags.
Monitoring tools can watch for a surge of unsolicited ARP replies or rapid changes in ARP tables.
Baseline comparison against a known-good inventory of IP-to-MAC pairs highlights anomalies.

You can inspect the local ARP table to look for a gateway whose MAC address unexpectedly matches another host:

arp -a

Two different IP addresses sharing one MAC address, particularly the gateway sharing with another device, strongly suggests poisoning.

Defending Against ARP Spoofing

Since ARP itself cannot be made trustworthy, defenses come from the surrounding infrastructure:

Dynamic ARP Inspection (DAI). Managed switches can validate ARP packets against a trusted binding of IP to MAC to port, dropping forged replies before they propagate.
DHCP snooping. By tracking legitimate address assignments at the switch, this feature builds the trusted bindings that DAI relies on.
Static ARP entries. For a small number of critical systems, hardcoding the IP-to-MAC mapping prevents it from being overwritten, though it does not scale well.
Network segmentation. Dividing the network into smaller broadcast domains through segmentation limits how many hosts an attacker can reach from any one vantage point.
Encryption everywhere. Ensuring services use authenticated encryption means that even successful poisoning yields little readable data.

Layering these controls addresses the attack at multiple levels: switch features stop the forged packets, segmentation limits reach, and encryption protects the data if a packet does slip through.

Key Takeaways

ARP has no authentication, so hosts cache forged replies that map a trusted IP to an attacker's MAC address.
ARP spoofing redirects local traffic through the attacker, providing the foothold for man-in-the-middle attacks.
The attack grants network position but does not by itself defeat correctly validated TLS.
Detection watches for duplicate MACs, unsolicited ARP replies, and unexpected changes in ARP tables.
Dynamic ARP Inspection with DHCP snooping, segmentation, and pervasive encryption are the strongest defenses.

arp-spoofinglayer-2mitmnetwork-securityspoofing