ARP Spoofing
What is ARP Spoofing?
ARP SpoofingA local-network attack that sends forged ARP messages to bind the attacker's MAC address to another host's IP, redirecting traffic through the attacker.
ARP spoofing — also called ARP poisoning — exploits a design decision baked into ARP since RFC 826 (1982): the protocol is stateless and unauthenticated, so any host will trust an unsolicited ("gratuitous") ARP reply and overwrite its cache. The attacker forges a reply claiming to own a target IP — typically the default gateway — and the victim silently updates its ARP table. For a full man-in-the-middle the attacker poisons both directions (victim→gateway and gateway→victim) and enables IP forwarding, so traffic flows through them transparently while both ends see normal connectivity.
Once in path, the attacker can sniff plaintext, hijack sessions via stolen cookies, run SSL stripping (Moxie Marlinspike's sslstrip, 2009) to downgrade HTTPS, tamper with responses, or selectively drop packets. It is the classic LAN primitive automated by arpspoof (dsniff), Ettercap, Bettercap, and the historic Cain & Abel. IPv6 has an analogous weakness in Neighbor Discovery (NDP spoofing).
Defences: Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP-snooping binding table and drops mismatches; static ARP entries pin critical hosts; arpwatch alerts on MAC/IP changes; port security and 802.1X limit rogue devices; and end-to-end encryption plus HSTS make intercepted traffic useless.
flowchart LR A[Attacker] -->|"gratuitous ARP: I am the gateway"| V[Victim] A -->|"gratuitous ARP: I am the victim"| G[Gateway/Router] V -->|traffic to Internet| A A -->|forwarded| G G -->|reply| A A -->|forwarded| V A -.->|sniff / SSL strip / modify| A
● Examples
- 01
An attacker on a corporate Wi-Fi tricking laptops into routing traffic through their laptop to harvest credentials.
- 02
Using Ettercap or arpspoof to perform a man-in-the-middle attack on an unencrypted protocol.
● Frequently asked questions
What is ARP Spoofing?
A local-network attack that sends forged ARP messages to bind the attacker's MAC address to another host's IP, redirecting traffic through the attacker. It belongs to the Attacks & Threats category of cybersecurity.
What does ARP Spoofing mean?
A local-network attack that sends forged ARP messages to bind the attacker's MAC address to another host's IP, redirecting traffic through the attacker.
How do you defend against ARP Spoofing?
Defences for ARP Spoofing typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for ARP Spoofing?
Common alternative names include: ARP poisoning, ARP cache poisoning.