Quick answer: ARP spoofing (ARP poisoning) is when an attacker on a local network sends forged ARP replies to associate their own MAC address with another device's IP (usually the gateway). This makes the victim's traffic flow through the attacker, putting them in an adversary-in-the-middle (MITM) position. In this position they can sniff, modify or hijack sessions. Defense is dynamic ARP inspection (DAI), static ARP, network segmentation and always using encrypted protocols.

How does ARP spoofing work?

Devices on a local network find each other by MAC address, not IP, and learn this mapping with the ARP protocol. ARP's fundamental weakness is this: when a device sends a reply saying "this IP is mine," other devices accept it without verification. The attacker exploits exactly this: by sending forged ARP replies to the network, they claim "I am the gateway."

As a result, the traffic that should go to the gateway comes to the attacker. By forwarding the traffic to the real gateway, the attacker does not break the connection but sits in the middle. In this MITM position, they can read and modify unencrypted traffic and capture sensitive data such as session cookies.

What can ARP spoofing do?

Attack Description
Traffic sniffing Reading unencrypted data (HTTP, FTP)
Session hijacking Entering an account with a captured session cookie
Traffic modification Altering responses in the middle
Denial of service Misrouting traffic to break access

Defense methods

  1. Enable dynamic ARP inspection (DAI) on managed switches.
  2. Define static ARP entries for critical devices.
  3. Narrow the area the attacker can reach with network segmentation.
  4. Always use encrypted protocols (HTTPS, SSH); even with MITM, the content is protected.
  5. Monitor unusual ARP activity and duplicate IP warnings with arpwatch and Wireshark.

An important point: the strongest antidote to ARP spoofing is encryption. Even if the attacker gets in the middle, if traffic is end to end encrypted (HTTPS, SSH) they cannot read the content. That is why removing unencrypted protocols is a critical defense.

The KAOS and DSET approach

In internal network penetration tests DSET tests ARP spoofing and MITM paths in an authorized way and evaluates the network's resilience against this classic attack. With Wireshark we tie unencrypted credential leakage and MITM traces in the traffic to evidence. In our field experience the most common problem is unencrypted protocols still in use on the internal network and ARP inspection being disabled. Our goal is to show how open the network is to a man-in-the-middle attack.

Related reading: network traffic analysis with Wireshark, network segmentation and microsegmentation, wireless network Wi-Fi penetration testing, AiTM adversary-in-the-middle phishing, TLS SSL configuration hardening, pivoting and tunneling.

Frequently asked questions

Are ARP spoofing and ARP poisoning the same? Yes, both describe the same attack. The attacker associates their own MAC address with another device's IP (usually the gateway) through forged ARP replies and routes the victim's traffic through themselves. This puts them in an adversary-in-the-middle (MITM) position.

Can ARP spoofing read encrypted traffic? No. Even if the attacker reaches a MITM position, if traffic is end to end encrypted (HTTPS, SSH) they cannot read the content; they only see metadata such as source, destination and volume. That is why the most effective defense against ARP spoofing is removing unencrypted protocols and using encryption everywhere.

How do I detect ARP spoofing? A sudden mapping of an IP address to a different MAC on the network, duplicate IP warnings and unusual ARP reply traffic are typical signs. Tools like arpwatch monitor changes in ARP mappings, and Wireshark shows suspicious ARP activity. Dynamic ARP inspection (DAI) on managed switches prevents the attack from the start.

Sources

To test your internal network's resilience against ARP spoofing and MITM attacks, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.