ARP Spoofing: How a Stateless Protocol Becomes a Machine-in-the-Middle

ARP resolves an IP address to a MAC address so a frame can be delivered on the local segment. It was designed for cooperative networks and includes no authentication whatsoever — a host accepts whatever answer arrives, and in many implementations accepts answers to questions it never asked. That is the entire vulnerability.

How the protocol works, and where it fails

A host needing to reach an IP address on its own subnet broadcasts an ARP request: who has this address? The owner replies with its MAC address, and the requester caches the mapping for a few minutes.

Three properties make this exploitable. There is no way to verify that a reply came from the rightful owner. Many implementations accept gratuitous ARP — an unsolicited announcement — and update the cache from it. And a later reply simply overwrites an earlier one, so the attacker who speaks last wins.

An attacker therefore sends continuous forged replies telling the victim that the gateway's IP address has the attacker's MAC address, and telling the gateway that the victim's IP address has the attacker's MAC address. Both caches are poisoned, both send their traffic to the attacker, and the attacker forwards it on so everything keeps working.

What the position enables

Traffic interception is the immediate result, and unencrypted protocols are read directly. TLS limits the damage, but the position still allows attempts to strip or downgrade connections, and it reveals which hosts are talking to what regardless of encryption.

Modification is possible too, since the attacker is forwarding rather than merely observing. And simply not forwarding turns it into a denial of service against one host or the whole segment.

Note that this is a layer 2, same-segment attack. The attacker must already be on the local network — through a wall jack, a compromised host, or wireless access — which is why it appears in internal assessments constantly and in external ones never. It is also frequently the enabling step for other attacks: putting yourself on the path is how you see the authentication exchanges that NTLM relay depends on.

The controls that work

Dynamic ARP Inspection is the direct answer. The switch validates every ARP packet on untrusted ports against a table of legitimate IP-to-MAC bindings and drops anything that does not match. Forged replies never reach their targets.

DAI depends on knowing the correct bindings, which it gets from the DHCP snooping binding table — the switch watches DHCP exchanges on untrusted ports and records which address was assigned to which MAC on which port. Statically addressed devices need manual entries. The two features are deployed together, and DHCP snooping brings its own benefit: it blocks rogue DHCP servers, which are the other classic same-segment attack, and the reason DHCP hardening and ARP hardening are usually one project.

Port security limits how many MAC addresses a port may learn, which constrains MAC flooding and some spoofing variants. Private VLANs prevent hosts on the same segment from reaching each other at all, which removes the attack where it applies.

802.1X authenticates the device before the port carries any traffic, so an unauthorized laptop never gets to send a forged packet — the port-based control described under 802.1X.

Static ARP entries work and do not scale; reserve them for the handful of genuinely critical mappings.

Detection

The signature is a MAC address changing for an established IP address, and the same MAC appearing for several IP addresses at once. Both are visible in ARP tables and in switch logs.

A burst of gratuitous ARP traffic is another indicator, since normal networks produce very little of it. Where DAI is enabled, its drop events are a direct alert — a dropped ARP packet on an untrusted port means something sent a reply it had no right to send. Feed those into your SIEM rather than leaving them in switch logs nobody reads.

Assume some segments will remain unprotected, and encrypt accordingly. End-to-end encryption means an attacker in the path sees metadata rather than content, which is the layered position to take: prevent where the switches support it, and make interception low-value everywhere else.

Exam angles

Know that ARP has no authentication and that cache poisoning through forged or gratuitous replies enables a machine-in-the-middle on the local segment. Name Dynamic ARP Inspection as the primary control and DHCP snooping as the source of its binding table. Recognize port security, private VLANs and 802.1X as supporting controls, and understand that the attack requires local network access, which is why it is an internal rather than an internet-facing threat.