How ARP Works, and How ARP Spoofing Creates a Man-in-the-Middle

ARP (Address Resolution Protocol) connects the two address systems on a local network: IP addresses (layer 3) and MAC addresses (layer 2). Before your laptop can send anything to the router, it must learn the router's MAC address. The lesson above shows that exchange, then how an attacker on the same network abuses it.

1. ARP request and reply

1. Request (broadcast): "Who has 192.168.1.1? Tell 192.168.1.10", sent to ff:ff:ff:ff:ff:ff so every device receives it.
2. Reply (unicast): only the owner answers: "192.168.1.1 is at 00:1a:2b:00:00:01".
3. The laptop stores the pair in its ARP cache. Check yours with arp -a (Windows/macOS) or ip neigh (Linux).

2. ARP spoofing (ARP poisoning)

ARP has no authentication, and most systems accept replies they never asked for. An attacker on the same LAN sends fake replies to the victim ("I am the router") and to the router ("I am the victim"). Both caches now point to the attacker's MAC.

arp.duplicate-address-detected

3. Man-in-the-middle

With poisoned caches, traffic between the victim and the router flows through the attacker, who can read it, change it, or forward it so nothing looks wrong. Unencrypted logins (plain HTTP, FTP, Telnet) are exposed immediately.

4. Defences

• Dynamic ARP Inspection on managed switches, backed by DHCP snooping, drops ARP replies that don't match known IP-MAC bindings.
• Encrypt everything: HTTPS, SSH and VPNs make intercepted traffic useless.
• Static ARP entries for critical gateways, arpwatch alerts, port security and 802.1X.

ip dhcp snooping vlan 10
ip arp inspection vlan 10

FAQ