What is ARP Spoofing? How the attack poisons your network

You are on a corporate network, or in a cafe with Wi-Fi. Everything looks normal: the laptop connects, the browser opens, email works. What you do not know is that someone on the same network is intercepting every packet you send before forwarding it on to its destination. That is ARP Spoofing — a silent attack operating at a layer most people never think to protect.

What the ARP protocol is and why it matters

ARP stands for Address Resolution Protocol. It exists to solve a basic communication problem on local networks: a device knows the destination IP address (192.168.1.1, say), but to send the physical packet across the network it needs the MAC address — the unique identifier of the other device's network card.

The process is simple: the device shouts to the whole network (a broadcast): "Who has IP 192.168.1.1? Tell me your MAC." Whoever owns that IP replies with its MAC address. That reply is stored in a local cache — the ARP table — so the question does not have to be asked every time.

Here is the problem: the ARP protocol has no authentication. Any device on the network can answer an ARP request, even one it was never asked. And operating systems, by default, accept those replies without question.

How ARP Spoofing works in practice

The attacker sends forged ARP replies (gratuitous ARP) to two targets at the same time:

• To the victim: "The router's IP (192.168.1.1) maps to my MAC." The victim updates its ARP table and starts sending all its traffic to the attacker's machine.
• To the router: "The victim's IP maps to my MAC." The router updates its table too, and sends replies meant for the victim to the attacker.

The result is a triangle: victim to attacker to router, with the attacker sitting in the middle of all communication. That is why ARP Spoofing is the foundation of a Man-in-the-Middle (MITM) attack: traffic keeps flowing normally so nothing looks suspicious, but it passes through the intruder's machine.

Tools like arpspoof (part of the dsniff package) or Ettercap automate the whole process in seconds on a network with no defences.

What can an attacker do with intercepted traffic?

With traffic redirected, an attacker can capture plaintext credentials, inject malicious content into HTTP pages, steal session cookies and run SSL stripping attacks to downgrade HTTPS connections to HTTP. Unencrypted protocols such as HTTP, FTP, Telnet and POP3 are completely exposed.

Even HTTPS connections are not fully safe without the right configuration: SSL stripping techniques can make the victim's browser talk over HTTP while the attacker keeps an HTTPS connection to the server — the victim sees the padlock disappear, but plenty of users ignore that warning.

Who is vulnerable

Any network running IPv4 on a local segment is technically vulnerable to ARP Spoofing. In practice, the risk is highest on:

• Public Wi-Fi networks (cafes, hotels, airports) — there is no client isolation by default
• Corporate networks without VLAN segmentation — every device sitting in the same broadcast domain
• Development environments — often running unmanaged switches with no layer 2 protections

Home networks on consumer routers are less exposed simply because there are fewer devices — but they are not immune.

How to defend against ARP Spoofing

What are the main defences against ARP Poisoning?

The most effective defences combine switch-level protection (Dynamic ARP Inspection), VLAN segmentation and the use of a VPN or TLS across all sensitive traffic. In smaller environments without managed switches, the minimum is making sure all traffic uses HTTPS and a trustworthy VPN.

At the infrastructure level (corporate networks)

• Dynamic ARP Inspection (DAI): a feature available on managed switches from Cisco, HP/Aruba, Juniper and others. The switch validates every ARP reply against a DHCP snooping table before accepting it. Forged replies are dropped before they ever reach the hosts.
• DHCP Snooping: tracks which IP was assigned to which switch port — a prerequisite for DAI to work at all.
• VLAN segmentation: limits the broadcast domain. If each department sits on its own VLAN, an attacker on one VLAN cannot send ARP to hosts on another without going through a router with a firewall.
• Port Security: restricts how many MACs can communicate per switch port, making it harder to inject ARP replies.

At the host and user level

• Static ARP entries: you can add the gateway's MAC manually with arp -s on Windows or Linux, pinning the entry in the cache so forged replies cannot overwrite it. Impractical on large networks, workable for small critical environments.
• VPN: even if an attacker intercepts the traffic, the packets are encrypted. A properly configured VPN is the most practical protection layer for users on public networks.
• HTTPS and HSTS: sites that implement HTTP Strict Transport Security (HSTS) block SSL stripping — the browser refuses HTTP connections for that domain. Check whether the sites you use are on the HSTS preload list.
• Pay attention to certificate warnings: if the browser flags an invalid certificate or an insecure connection on a network that looked trustworthy, consider the possibility of an active MITM.

ARP Spoofing and other network attacks

ARP Spoofing is rarely the final attack — it is the position. Once traffic is redirected, the attacker can chain other techniques onto it. A close relative is LLMNR Poisoning, which also operates at the name resolution layer on Windows networks: where ARP poisons the IP-to-MAC mapping, LLMNR Poisoning poisons name resolution, capturing NTLMv2 hashes whenever a device tries to reach a network share. Both exploit unauthenticated protocols running on the local network.

A successful MITM can also lead to session cookie theft — letting the attacker take over authenticated accounts without ever needing the password, a scenario covered in detail in the article on session hijacking.

The bigger lesson

ARP was designed in the 1980s for small, trusted networks, where authentication between devices seemed unnecessary. Four decades later, that unverified protocol is still present on practically every IPv4 network on the planet. The defences exist — DAI, VLAN, VPN — but they have to be actively configured. The insecure setting is the default.

If you administer a corporate network, check whether your switches support Dynamic ARP Inspection and whether DHCP Snooping is enabled. If you are a user, never touch sensitive systems on a public network without a VPN — and pay attention when the browser padlock disappears.