ARPPoisoning

ARPPoisoning, also known as ARP spoofing, is a technique that exploits weaknesses in the Address Resolution Protocol (ARP) used on IPv4 local networks. ARP is responsible for mapping IP addresses to MAC addresses, enabling devices to communicate on a LAN. Because ARP provides no built-in authentication, an attacker can send forged ARP messages to associate the attacker's MAC address with the IP address of another host, such as a gateway or another device.

When successful, ARP poisoning can redirect network traffic through the attacker’s device. This enables eavesdropping, unobtrusive modification of traffic, or disruption of communications. On a switched network, a poisoned ARP cache can create a man-in-the-middle situation where the attacker forwards traffic between two endpoints while potentially inspecting or altering it. In some cases, multiple hosts can be affected, leading to broader denial of service or data leakage.

ARPPoisoning typically requires the attacker to be on the same local network segment as the victim(s). It is more feasible on networks that lack proper isolation or protective measures, and it can be less effective on networks with switches that implement security features or with segmentations such as VLANs.

Prevention and mitigation focus on reducing ARP Trust, detecting anomalies, and enforcing network controls. Measures include static ARP entries for critical devices, enabling Dynamic ARP Inspection on capable switches, using port security, and implementing network segmentation or VLANs. Cryptographic protections such as TLS, IPsec, or VPNs can protect sensitive data even if ARP caches are poisoned. Network monitoring and anomaly detection can help identify unusual ARP traffic patterns indicative of poisoning attempts.