What Is ARP poisoning? Security Definition

Imagine you live in a neighborhood where every house has a street address (like an IP address) and a family name (like a MAC address). Normally, when the mail carrier delivers a package, they check a list that tells them which family lives at which address. That list is updated whenever someone new moves in.

Now, imagine a dishonest neighbor sneaks in at night and changes the list. They erase your family name from your address and write their own name instead. From that point on, all your packages, letters, bills, birthday gifts, get delivered to their house. They open your mail, read your letters, and maybe even change the contents before sending them on their way to you (if they send them at all). That is exactly what ARP poisoning does, but on a computer network instead of a street.

ARP, which stands for Address Resolution Protocol, is the system that maps IP addresses (like street addresses) to MAC addresses (like family names). Every device on a local network uses ARP to ask, “Who has this IP address?” The device with that IP responds with its MAC address. This exchange is stored in a small table called the ARP cache so the device remembers where to send data next time.

During an ARP poisoning attack, a bad actor sends fake ARP replies to the devices on the network. The attacker claims that a certain IP address, for example, the IP of the network router or a server, belongs to the attacker’s own MAC address. The victim devices believe these false messages and update their ARP cache with the wrong information. Now, when the victims try to send data to the router or server, the data actually goes to the attacker’s computer first.

Once the data reaches the attacker, they can do several things. They can quietly read the data and forward it to the real destination, a technique called sniffing. They can change the data before sending it on, which is called a man-in-the-middle attack. Or they can simply not forward the data at all, causing the network connection to break, which is a denial-of-service attack.

ARP poisoning is dangerous because ARP itself was designed for trust. There is no built-in security to check whether an ARP reply is genuine. Any device on the same local network can make false claims about IP-to-MAC mappings. This is why securing local networks is so important, especially in places like coffee shops, offices, or school networks where many different people connect to the same Wi-Fi.

You may have heard of attacks where someone steals passwords on public Wi-Fi. ARP poisoning is often the first step in such attacks. The attacker first poisons the ARP cache of the victim and the router, placing themselves in the middle of the communication. Once they are in the middle, they can capture login credentials, session tokens, or any unencrypted information. This is why using encrypted connections like HTTPS or a VPN is critical on any network you do not fully control.

In short, ARP poisoning is a trick that exploits the trusting nature of a basic network protocol. It allows an attacker on the same local network to redirect data meant for someone else. Understanding this concept helps you grasp why network segmentation, encryption, and security tools like dynamic ARP inspection are necessary in both home and business networks.

ARP poisoning, also known as ARP spoofing, is a network attack in which an attacker sends falsified Address Resolution Protocol (ARP) messages onto a Local Area Network (LAN). The goal is to associate the attacker’s MAC address with the IP address of a legitimate network device, such as the default gateway or a server. This causes traffic intended for that legitimate device to be redirected to the attacker, enabling interception, modification, or disruption of network communications.

The Address Resolution Protocol is defined in RFC 826. It operates at the link layer (Layer 2) of the OSI model and is used to map a network-layer address (IPv4 address) to a physical hardware address (MAC address). When a device needs to communicate with another device on the same LAN, it first checks its ARP cache, a table stored in memory that contains recent IP-to-MAC mappings. If no entry exists, the device broadcasts an ARP request packet to the entire network, asking, “Who has IP address X?” The device that owns that IP responds with an ARP reply containing its MAC address. The requesting device then stores this mapping in its ARP cache for future use.

The fundamental vulnerability exploited in ARP poisoning is that ARP is stateless and does not authenticate the validity of ARP replies. A device will accept an ARP reply even if it never sent a corresponding request. This allows an attacker to send unsolicited ARP replies, often called gratuitous ARP, to inject false entries into the ARP caches of other devices on the same broadcast domain.

A typical ARP poisoning attack follows these steps. First, the attacker identifies the IP addresses of the target victim and the default gateway on the local network. Using a tool such as Ettercap, Bettercap, Arpspoof (from the dsniff suite), or Cain & Abel, the attacker begins sending falsified ARP replies. To the victim, the attacker sends an ARP reply that maps the gateway’s IP address to the attacker’s MAC address. To the gateway, the attacker sends an ARP reply that maps the victim’s IP address to the attacker’s MAC address. Both the victim and the gateway update their ARP caches with the false mappings. As a result, the victim sends outgoing traffic to the attacker, thinking it is the gateway, and the gateway sends incoming traffic for the victim to the attacker. The attacker then forwards packets between the two parties, acting as a man-in-the-middle (MITM). This is often called a “two-way” or “bidirectional” ARP poisoning.

Once the attacker is in the middle, they can perform several malicious actions. Packet sniffing allows them to capture and analyze all unencrypted traffic, including usernames, passwords, emails, and HTTP session cookies. Session hijacking is possible if the attacker steals a session token and impersonates the victim. Data modification occurs when the attacker intercepts traffic, alters the payload, and forwards it to the recipient, for example, changing the destination account number in a financial transaction. Denial of service (DoS) can be achieved by simply not forwarding the traffic after poisoning, effectively cutting the victim off from the network.

ARP poisoning is typically limited to a single broadcast domain (a VLAN or a subnet). Attacks cannot cross routers since routers do not forward ARP broadcasts. However, within a VLAN, every device is vulnerable. Network switches do not inherently prevent ARP poisoning; even managed switches forward ARP broadcasts to all ports within a VLAN unless port security or dynamic ARP inspection (DAI) is configured.

Defenses against ARP poisoning include several techniques. Static ARP entries manually hardcode IP-to-MAC mappings in critical devices, but this is not scalable. Dynamic ARP Inspection (DAI) on managed switches examines ARP packets and validates them against a trusted DHCP snooping binding table, dropping invalid ARP replies. DAI is a feature commonly found in Cisco switches and is recommended as a best practice for enterprise networks. Port security can limit the number of MAC addresses allowed on a switch port, making it harder for an attacker to use multiple MACs. Network segmentation using VLANs and separate subnets reduces the attack surface by limiting the number of devices in a broadcast domain. Encryption at higher layers, such as HTTPS, TLS, and SSH, prevents attackers from reading captured data even if ARP poisoning occurs. VPNs also provide a secure tunnel, but they do not prevent the attack on the local network.

In real IT implementations, ARP poisoning is a common first step in penetration testing and red team exercises. It is used to demonstrate the need for network security controls. Professionals are expected to both understand how to execute the attack for testing and how to configure defenses. On exam objectives, ARP poisoning appears in the context of network security threats, MITM attacks, and switch security features. It is especially relevant to the CompTIA Network+ and Security+, Cisco CCNA, AWS Solutions Architect (if discussing VPC design and security groups), and Azure AZ-104 (when covering virtual network security).

The attack is also related to other threats such as DNS spoofing, where false DNS responses are injected, and DHCP spoofing, where a rogue DHCP server assigns attacker-controlled IP configurations. ARP poisoning can be used to facilitate these other attacks by placing the attacker in the path of the victim’s traffic.

Overall, ARP poisoning remains a significant threat on legacy and unsecured networks. Modern operating systems implement some protections, such as ignoring unsolicited ARP replies in certain configurations, but these are not foolproof. Understanding the mechanism, the tools, and the mitigations is essential for any IT professional responsible for network security.

ARP poisoning matters because it is one of the most common and dangerous attacks that can happen on a local network, and it often serves as the stepping stone for more severe exploits. For IT professionals, understanding ARP poisoning is essential for defending networks, especially in environments where multiple users share the same broadcast domain, such as office LANs, school labs, public Wi-Fi hotspots, and conference venues.

From a practical standpoint, ARP poisoning undermines the basic trust model of the Address Resolution Protocol. Since ARP has no built-in authentication, any device on the same network can claim any IP address. This makes it straightforward for attackers to position themselves between two communicating devices. Once in the middle, they can capture sensitive data like login credentials, financial information, or proprietary business files. In a corporate environment, this could lead to data breaches, regulatory fines, and loss of customer trust.

For network administrators, ARP poisoning forces the implementation of additional security measures. Features like Dynamic ARP Inspection (DAI), DHCP snooping, port security, and VLAN segmentation are not optional bells and whistles; they are necessary controls to prevent a simple attack from compromising the entire network. A single unsecured switch port could allow an attacker to launch ARP poisoning and intercept traffic across the VLAN. This is why industry standards and exam objectives emphasize these defensive technologies.

ARP poisoning highlights the importance of defense in depth. Even if an attacker successfully poisons the ARP cache, encryption at higher layers (such as HTTPS, SSH, or a VPN) can render the captured data unreadable. This means that network security is not just about preventing attacks, but also about mitigating the damage if an attack occurs. IT professionals must advocate for and enforce encryption policies, even on internal networks.

Finally, ARP poisoning remains relevant because it is easy to execute. Free and open-source tools are widely available, and many tutorials exist online. This means that even low-skilled attackers can launch ARP poisoning attacks, making it a common threat. For anyone preparing for IT certification exams like the CompTIA Network+, Security+, or CCNA, knowing how ARP poisoning works and how to stop it is a core competency. It is not a theoretical concept; it is a real-world vulnerability that demands real-world solutions.

ARP poisoning appears in certification exam questions primarily in three patterns: scenario-based identification, mitigation selection, and configuration/troubleshooting. Understanding these patterns will help you quickly recognize the correct answer.

Scenario-based identification questions present a situation and ask you to identify the attack type. For example, “A security analyst notices that a user’s computer is sending traffic to the attacker’s MAC address instead of the default gateway. All devices are on the same VLAN. Which type of attack is occurring?” The correct answer is ARP poisoning or ARP spoofing. Key clues in the scenario include: devices on the same local network, traffic being redirected, MAC address table inconsistencies, and the attacker being able to capture unencrypted data. Sometimes the question will describe the result, such as “Users report that they can see each other’s network traffic” or “An attacker is able to intercept and modify data between the client and server.”

Another common question pattern is mitigation selection. For instance, “Which of the following would best prevent ARP spoofing attacks on a switched network?” The options might include enabling STP, implementing dynamic ARP inspection, disabling DTP, or using VTP. The correct answer is dynamic ARP inspection (DAI), often in conjunction with DHCP snooping. Some exams may also consider using static ARP entries for critical devices, but DAI is the more scalable enterprise solution. You may also see “Enable port security” as a distractor, but port security alone does not prevent ARP poisoning; it only limits the number of MAC addresses per port.

Configuration and troubleshooting questions are common in the CCNA. You might be shown output from a show ip arp or show mac address-table command. For example, “The output shows that the MAC address 00:11:22:33:44:55 is associated with two different IP addresses on the same switch port. What is the most likely cause?” The answer could be ARP poisoning if the ARP cache has been corrupted. Alternatively, you could be asked to configure a switch to drop ARP packets that do not match a DHCP snooping binding. You would need to know that the commands are ip dhcp snooping and ip arp inspection vlan [vlan-id] on Cisco switches.

Some questions combine multiple concepts. For example, “An attacker uses ARP spoofing to intercept traffic between a client and a server. The attacker then modifies the data before forwarding it. Which two additional attacks does this enable?” The answers could be session hijacking and data tampering. The question is testing whether you understand the consequences beyond the initial poisoning.

In Security+, you may see a question like, “A company’s security policy requires that all network traffic between endpoints be encrypted even though the network is segmented. An attacker is able to perform an ARP spoofing attack on the network. Which security principle does encryption address?” The answer is defense in depth, or more specifically, mitigating the impact of an attack even if the perimeter is breached.

Finally, some questions ask about the scope of the attack. “An ARP poisoning attack occurs on a network with multiple VLANs. Which of the following is true?” The correct answer is that the attack is limited to a single broadcast domain (the VLAN where the attacker resides). The attacker cannot poison ARP caches across VLANs unless there is a router or a switch configured with inter-VLAN routing that also trusts the attacker’s ARP replies.

To succeed with these questions, focus on the key characteristics: it is LAN-based, it exploits the lack of ARP authentication, it requires the attacker to be on the same subnet, and it can be mitigated by DAI, DHCP snooping, port security, or encryption. Memorize the tools used for ARP poisoning (like arpspoof, Ettercap) and the defensive features (DAI, DHCP snooping). With this knowledge, you will navigate exam questions confidently.