ARP Spoofing and Its Risks

The Core Weakness ARP Spoofing Exploits

ARP, as originally designed, has no built-in way to verify that a reply actually comes from the device it claims to be from - a device is simply trusted to be telling the truth about which MAC address it owns.

How an Attacker Exploits This Trust

Normal:  "192.168.1.1 is at AA:BB:CC:11:22:33"  (the real router)

Spoofed: "192.168.1.1 is at XX:XX:XX:99:99:99"  (the attacker's own MAC address, sent as a lie)

An attacker sends forged ARP replies claiming to own an IP address - like the network's default gateway - that actually belongs to another device. Victims on the network update their ARP caches with this false information, unknowingly believing the attacker's MAC address is the legitimate router.

What This Enables: A Man-in-the-Middle Position

Once victim devices are tricked into sending their gateway-bound traffic to the attacker's MAC address instead, the attacker can intercept, inspect, and even modify traffic passing through - directly enabling exactly the man-in-the-middle attack covered earlier in this project's network attacks note.

Warning Signs of ARP Spoofing

• A device's ARP cache entry for a critical address (like the gateway) suddenly changes to an unrecognized MAC address.
• Unusual traffic patterns or unexpected latency, since traffic is quietly being routed through an attacker.
• Dedicated ARP monitoring tools specifically designed to detect suspicious, conflicting ARP replies on a network.

Common Defenses Against ARP Spoofing

• Static ARP entries - manually configuring critical mappings (like the gateway) so they cannot be overwritten by a forged reply.
• Dynamic ARP Inspection - a switch feature that validates ARP messages against known-legitimate mappings before allowing them through.
• Network segmentation - using VLANs (covered earlier in this project) to limit how much of a network an attacker's local ARP spoofing can actually reach.