What Is ARP Spoofing? How ARP Poisoning Enables MITM Attacks

ARP spoofing (also called ARP cache poisoning) is a local-network man-in-the-middle attack in which an attacker sends forged Address Resolution Protocol (ARP) replies so that other devices link the attacker's MAC address to someone else's IP address, usually the default gateway. Traffic meant for that IP then flows through the attacker, who can read, alter or drop it. It works because ARP has no authentication. Strictly, spoofing is the act of sending forged ARP replies; poisoning is the corrupted cache that results. Defenses include Dynamic ARP Inspection, segmentation and encryption.

Key Takeaways

• Definition: ARP spoofing is a local-network (Layer 2) attack that forges ARP messages to associate the attacker's MAC address with a victim's IP address.
• Where it happens: on flat IPv4 LANs, wired or wireless, where the attacker already has local network access.
• What it enables: interception, modification or disruption of traffic, for example between a workstation and the default gateway.
• Impact: credential theft, session hijacking, malware injection and denial of service, often with low visibility.
• Why it matters: it breaks the implicit trust of local networks and remains a common internal network risk where segmentation and monitoring are weak.
• Mitigations: network segmentation, switch protections (DHCP snooping and Dynamic ARP Inspection), encryption (TLS) and continuous monitoring.

What ARP Does and Why It Can Be Abused

ARP, defined in RFC 826, resolves IPv4 addresses to link-layer (MAC) addresses on a local subnet. A host that wants to reach an IP address broadcasts a request, the owner replies with its MAC address, and the requester stores that mapping in its ARP cache.

ARP spoofing abuses this process. A malicious host injects fake ARP messages into the subnet to re-map IP addresses to its own MAC address. In plain terms, the attacker tells other devices "I am the router" (or another host), and they start sending traffic through the attacker. This works because ARP has no built-in authentication: any device can reply to an ARP request, and hosts trust the reply. An attacker on the same Ethernet or Wi-Fi segment can therefore trick victims into sending packets to the attacker's machine. This lets the attacker intercept, inspect or alter network traffic, a classic man-in-the-middle attack.

ARP spoofing is still relevant because most enterprise networks still run IPv4, which relies on ARP. IPv6 replaces ARP with the Neighbor Discovery Protocol (NDP). NDP has an optional cryptographic extension, Secure Neighbor Discovery (SEND), but it is rarely deployed, so NDP spoofing is the IPv6 equivalent of this attack. Security teams see ARP spoofing in internal and campus networks where an insider or a compromised device gains local access. A malware-infected workstation or a rogue Wi-Fi client, for example, can poison ARP caches in its subnet to spy on other machines.

MITRE ATT&CK tracks the technique as Adversary-in-the-Middle: ARP Cache Poisoning (T1557.002) and lists real-world use: the Cleaver group has used custom tools to facilitate ARP cache poisoning, and LuminousMoth has used ARP spoofing to redirect a compromised machine to an attacker-controlled website.

Dynamic ARP Inspection can pass a configuration audit and still leave gaps in production, for example when it covers only some VLANs or trusts too many ports. Our Red Teaming Services test whether your Layer 2 controls actually hold.

How ARP Spoofing Works

Normally, when Host A wants to send a packet to IP X, it broadcasts "Who has IP X?" on the LAN. The true owner replies "IP X is at MAC M," and Host A caches that answer. The weakness is that any host can send a forged reply, and many operating systems accept it, even when they never sent a request. An attacker sends fake ARP replies that bind the attacker's MAC address to another IP, often the gateway's. Victims update their ARP caches and send traffic to the attacker's MAC instead of the legitimate device.

1. Local access and discovery: the attacker must be on the same IPv4 LAN, wired or wireless, as the targets. They first identify key addresses, such as the router's IP and the victim's IP, typically with a network scan of the subnet.
2. Forge ARP replies: using a spoofing tool or script, the attacker sends unsolicited ARP replies, for example "192.168.1.1 (the router) is at AA:BB:CC:DD:EE:FF (the attacker's MAC)." Attackers usually poison both directions: they tell the router that the victim's IP is at the attacker's MAC, and tell the victim that the router's IP is at the attacker's MAC.
3. Victims update their ARP caches: the victim and the gateway trust the forged replies and store the attacker's MAC for the spoofed IP.
4. Traffic interception and forwarding: packets destined for the router now reach the attacker, who can capture and log them. The attacker enables IP forwarding so traffic still reaches its real destination, which keeps connections working and the victim unaware. If the attacker drops the traffic instead, the result is a denial of service.
5. Maintain the poisoning: because ARP entries expire or get corrected, attackers keep sending periodic spoofed replies, often as gratuitous ARPs, to keep the false mappings in place.

Many hosts accept unsolicited ARP replies at any time, and the protocol itself offers no guardrail. During authorized penetration tests, tools such as Bettercap, Ettercap or arpspoof automate step 2 and can link many IPs to the tester's MAC at once. The attacker effectively pretends to be both ends of the conversation and sits in the middle of it.

Real-World Examples

ARP spoofing is most commonly observed inside networks:

• LAN MITM on corporate and Wi-Fi networks: an attacker on a corporate Ethernet segment, or on a public Wi-Fi network that puts all clients in one subnet, can poison the cache entries for the local gateway. In a coffee shop, an attacker might spoof the router and capture any unencrypted logins or session cookies sent by other customers. In an office, malware could poison a file server's IP to intercept data exports or inject commands.
• Session hijacking and data theft: once in the middle, the attacker can sniff traffic, collecting plaintext passwords, internal documents or proprietary data. They can also hijack sessions, for example by capturing a web session cookie. Because the attack happens below the application, it bypasses application-layer controls unless traffic is encrypted.
• Malware injection and redirects: the attacker can substitute a malicious executable or script in transit, or redirect requests such as DNS lookups to attacker-controlled servers. LuminousMoth's documented use of ARP spoofing to send a victim to an attacker-controlled site is one example.

Legitimate uses: ARP-related techniques are also used defensively. Administrators set static ARP entries for critical devices, hard-coding the router's IP-to-MAC mapping to prevent poisoning. Engineers run ARP monitoring tools such as arpwatch to audit network changes. In penetration testing, ARP spoofing is simulated with permission to evaluate an organization's network defenses. ARP itself is fundamental to every IPv4 Ethernet network; ARP spoofing is the abuse of it to gain visibility into LAN traffic.

Why ARP Spoofing Is Important

ARP spoofing can undermine a network's confidentiality and integrity. When it succeeds, attackers bypass perimeter defenses by working inside the LAN. They can silently capture sensitive corporate or personal data and inject harmful traffic. The impacts include stolen passwords and documents, malware delivered inside legitimate sessions, and denial of service when traffic is dropped or ARP traffic floods the segment.

The business consequences follow: a breach that starts with ARP poisoning can lead to regulatory penalties, loss of customer trust and expensive incident response. Many internal services still use unencrypted protocols, so an attacker who spoofs a gateway can capture everything from database queries to login attempts. Even when data is encrypted, ARP spoofing can disrupt sessions or steer devices toward rogue DNS servers. Because the attack is simple and the tools are freely available, any flat, poorly monitored LAN is at risk.

Common Abuse or Misuse

Attackers use ARP spoofing mainly as an internal technique. After gaining a foothold, for example through phishing or a compromised host, an adversary can use ARP spoofing during lateral movement to sniff traffic from other machines on the LAN and collect credentials. Tools are widely available: arpspoof (part of the dsniff suite), Ettercap and Bettercap all automate the attack. That low barrier makes ARP poisoning a common choice during internal reconnaissance or data collection.

The technique is effective because ARP has no challenge-response step, so hosts trust updates. Attackers can send unsolicited or gratuitous ARPs continuously to keep caches poisoned. Detecting a malicious ARP packet on its own is hard because ARP traffic is frequent and one spoofed packet looks like a routine update. An attacker can also throttle their packets to stay below rate-based alarms.

ARP spoofing is often paired with MAC address spoofing (changing the attacker's NIC MAC to impersonate another device) and can complement DNS or DHCP spoofing. Once active, it can be hard to spot without monitoring, because switches typically do not log ARP packets by default and many hosts do not alert when an ARP entry changes. This is why security teams emphasize proactive controls (see below) over reactive fixes. A related local-network attack is DHCP starvation, which exhausts a DHCP server's pool of available addresses.

Detection and Monitoring

Detecting ARP spoofing means looking for inconsistent ARP mappings or unusual ARP traffic. Key approaches:

• ARP table anomalies: a telltale sign is several IP addresses mapping to one MAC address in a host's ARP cache. Running arp -a and seeing two different IPs with the same MAC means one is likely spoofed. Auditing ARP caches on critical hosts, manually or by script, can catch poisoning.
• Network traffic analysis: intrusion detection systems and packet capture can identify suspicious ARP behavior. Tools like arpwatch and IDS rules monitor ARP announcements; a burst of gratuitous ARP replies or an IP that suddenly changes MAC can trigger alerts. Some NIDS platforms include dedicated ARP checks, such as Snort 3's arp_spoof inspector (the arpspoof preprocessor in Snort 2), which alerts when Ethernet and ARP source or destination addresses do not match, or when an ARP request arrives in a unicast frame.
• Endpoint checks: endpoint logs are a weak source for ARP detection. Sysmon does not record ARP cache changes: according to Microsoft's Sysmon documentation, its network connection event (Event ID 3) logs the process, IP addresses, ports and hostnames, with no MAC addresses, and Event ID 22 is a DNS query event. On endpoints, baseline the gateway's MAC address and alert when it changes: schedule arp -a or Get-NetNeighbor on Windows and ip neigh on Linux, and flag any two IP addresses that share one MAC. For continuous coverage, rely on network-side sources such as arpwatch, IDS ARP rules and switch DAI logs.
• Switch and DHCP logs: with DHCP snooping and Dynamic ARP Inspection (DAI) enabled, the switch itself detects mismatches. DAI checks ARP packets against the DHCP snooping binding database (or static ARP ACLs where DHCP is not used) and, as Cisco's DAI configuration guide explains, intercepts, logs and discards ARP packets with invalid IP-to-MAC bindings. Reviewing switch logs after enabling these features shows blocked ARP attacks.
• Encrypted vs. unencrypted traffic: an ARP poisoner cannot read properly encrypted payloads, but metadata still leaks. Watch for certificate warnings, unexpected TLS downgrades and session anomalies, which can indicate someone in the path.

In practice, defenders look for ARP irregularities across endpoints and the network: multiple IP addresses resolving to a single MAC, unexpected gateway MAC changes and unusual volumes of gratuitous ARPs. A combination of periodic ARP cache snapshots, arpwatch or IDS alerts, and switch DAI and DHCP snooping logs works best. Blind spots include unmonitored segments and devices that do not report. Legitimate events such as DHCP lease changes or gateway failover can be noisy, so organizations tune thresholds and keep known-good baselines, such as expected gateway MAC addresses.

Mitigation and Prevention

Preventing ARP spoofing relies on network design and host controls together:

• Static ARP entries: in small or high-security environments, statically mapping MACs to IPs on critical hosts removes spoofing risk for those entries. Permanently assigning the router's MAC to its IP on each server ensures the server ignores forged ARPs for the gateway. This is administratively heavy and impractical at scale, but effective for key systems.
• Switch security features: managed switches support Dynamic ARP Inspection. When enabled, the switch checks ARP packets against IP-to-MAC bindings learned through DHCP snooping or static bindings and drops mismatches. Port security can limit each switch port to known MAC addresses, which stops an attacker from simply plugging in and claiming another identity. MITRE lists DHCP snooping and DAI among its mitigations for T1557.002.
• Network segmentation and isolation: keep sensitive devices on separate VLANs or subnets. ARP is confined to its broadcast domain and cannot cross a routed boundary, so an attack in one subnet does not affect devices in another. Dividing the internal network into well-segmented zones with firewalls or routers between them is a critical defense. Our guide to VLAN tagging explains how VLANs separate those domains.
• 802.1X and access control: port-based network access control (IEEE 802.1X) means a device must authenticate before it can join the LAN, which addresses the core requirement of ARP spoofing: link-layer access. Without a switch port or Wi-Fi association, ARP spoofing is not possible. Note that WPA2 and WPA3 Wi-Fi encryption do not stop an authenticated client from spoofing ARP to other clients; enable client isolation on guest and untrusted wireless networks.
• Encryption: encryption does not stop forged ARP messages, but it limits their impact. With VPNs or TLS on all communications, an attacker who intercepts packets cannot read the contents. When end-to-end encryption (HTTPS, SSH and similar) is enforced and certificates are validated, an ARP poisoner can generally disrupt connections or observe metadata, but cannot read or silently alter the protected content. Configuring TLS with perfect forward secrecy also means recorded traffic cannot be decrypted later if a server's long-term key is compromised.
• IPv6 segments: default NDP is also spoofable. Use RA Guard (RFC 6105) and ND inspection on switches, the IPv6 counterparts of DAI-style protection.
• Monitoring and response: continuous monitoring with arpwatch, IDS rules and switch logs is vital. If poisoning is detected, isolate the suspected host. Periodic ARP scans and alerts on gateway MAC changes speed up remediation.

Control checklist: what each defense stops and where it fails

No single measure is perfect, but together these controls make ARP poisoning far less effective and easier to detect, provided someone verifies they are actually enabled and enforced. That verification is where the red team and blue team division of labor matters, because DAI and port security can pass a configuration audit and still leave gaps in production. A network penetration test is the usual way to check.

Related Concepts

• ARP cache poisoning: another name for ARP spoofing. Strictly, spoofing is sending the forged replies and poisoning is the resulting corrupted cache, but the terms are used interchangeably.
• Man-in-the-middle (MITM) attacks: ARP spoofing is a classic LAN-level MITM attack. It belongs to a broader class of techniques where an attacker interposes between two parties; DNS spoofing is an application-layer example.
• DNS spoofing (DNS cache poisoning): DNS spoofing corrupts a resolver's entries so a domain name maps to a malicious IP. ARP poisoning works at the link layer for IP-to-MAC resolution, while DNS poisoning works at the application layer for hostname resolution. Both redirect traffic to attacker-controlled machines.
• MAC address spoofing: a host changing its own MAC address to mimic another device. It is often a precursor to ARP spoofing or a way to evade port security. It is not an attack by itself, but it facilitates ARP and network access attacks.
• IPv6 Neighbor Discovery Protocol (NDP): IPv6 uses NDP (RFC 4861) instead of ARP. NDP is not authenticated by default; the optional SEND extension (RFC 3971) adds cryptographic protection but is rarely deployed. In practice, defend IPv6 segments with RA Guard and ND inspection, because default NDP is also spoofable.
• Network segmentation: restricting broadcast domains ensures that an ARP spoof in one segment does not affect others. Segmentation complements Dynamic ARP Inspection.
• BGP hijacking: the routing-layer analog of ARP spoofing: instead of poisoning a local ARP table, an attacker redirects traffic by announcing routes it should not.

FAQs

How is ARP spoofing different from ARP caching?

ARP caching is a normal function in which a host remembers IP-to-MAC mappings. ARP spoofing (cache poisoning) is an attack that inserts false mappings into that cache. They differ in intent and in where the entries come from.

Can I detect ARP spoofing on Windows or Linux?

Yes. On Windows, run arp -a (or Get-NetNeighbor in PowerShell) and look for two IP addresses, especially the default gateway, sharing one MAC address. On Linux, use ip neigh. Sysmon does not log ARP cache changes (its Event ID 22 is a DNS query event), so for continuous detection use network-side tools such as arpwatch, an IDS ARP rule like Snort 3's arp_spoof inspector, or Dynamic ARP Inspection logs on your switches.

Does ARP spoofing work on cloud or Wi-Fi networks?

ARP spoofing requires Layer 2 access to the same segment. In typical public cloud networks such as AWS VPCs or Azure virtual networks, the provider's software-defined network handles address resolution, so customers generally cannot perform ARP spoofing there. On a private Wi-Fi or office LAN it works much as on Ethernet, because the access point bridges clients into the same subnet; WPA2 and WPA3 do not prevent it between authenticated clients. It fails when the network isolates clients (for example, with client isolation or per-host routing). IPv6-only segments face the equivalent NDP spoofing risk instead.

Are there common tools for performing ARP spoofing?

Yes. Widely used tools include Bettercap (actively maintained), Ettercap and arpspoof from the dsniff suite, all of which automate sending forged ARP replies. Older Windows tools such as Cain & Abel also had ARP spoofing modules but are no longer maintained. These tools are intended for authorized testing and auditing but are also misused by attackers.

How can I protect my network from ARP spoofing?

Enable DHCP snooping and Dynamic ARP Inspection on switches, use static ARP entries for critical devices, segment the network into separate subnets, and enforce port security or 802.1X. Encrypt traffic (VPN, HTTPS, SSH) so intercepted data is unusable even if ARP is poisoned. Monitor with arpwatch, IDS rules and switch logs to detect attacks early.

Does IPv6 eliminate ARP spoofing issues?

ARP does not exist in IPv6; Neighbor Discovery replaces it, so the classic IPv4 ARP poisoning attack does not apply to IPv6-only networks. However, NDP is not authenticated by default, and the optional SEND extension is rarely deployed, so attackers can spoof neighbor and router advertisements instead. Protect IPv6 segments with RA Guard and ND inspection.

What is a gratuitous ARP and is it bad?

A gratuitous ARP is an unsolicited ARP announcement a device makes, for example when its IP changes or to detect address conflicts. It is normally legitimate. Attackers abuse gratuitous ARPs by sending fake ones repeatedly to poison other hosts' caches. Gratuitous ARP is not inherently malicious, but it is the mechanism most often used in ARP spoofing; MITRE suggests considering disabling ARP cache updates from gratuitous replies where operationally possible.

Next Steps

ARP spoofing exploits the trust-based design of ARP. It lets an attacker with local access impersonate other devices at Layer 2 and transparently capture or manipulate traffic. Because ARP lacks authentication, any IPv4 LAN is potentially vulnerable without proper controls. Defenders have strong options: DHCP snooping and DAI, port security and 802.1X, segmentation, static ARP for key machines and encryption, backed by monitoring. The practical next step is to confirm that these controls are enabled on every relevant VLAN and actually block a spoofing attempt, ideally through an authorized test, so a covert foothold cannot turn into a full compromise.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• RFC 826: An Ethernet Address Resolution Protocol
• RFC 4861: Neighbor Discovery for IP version 6
• RFC 3971: SEcure Neighbor Discovery (SEND)
• RFC 6105: IPv6 Router Advertisement Guard
• MITRE ATT&CK T1557.002: ARP Cache Poisoning
• Cisco: Configuring Dynamic ARP Inspection (Catalyst 9300)
• Snort 3 arp_spoof inspector
• Microsoft Sysinternals: Sysmon