Skip to content

ARP spoofing

1. Context & stakes

Poison the ARP cache to intercept LAN traffic.

ARP has no authentication: a host caches whatever MAC-for-IP reply it hears, including unsolicited ones. By forging gratuitous ARP replies an attacker binds the gateway's IP to their own MAC and becomes a transparent man-in-the-middle for the whole subnet. ARP spoofing underpins most LAN MITM tooling and is countered by Dynamic ARP Inspection tied to DHCP snooping.

2. Theory

ARP resolves an IPv4 address to a MAC by broadcasting 'who has X?'; the owner replies 'X is at aa:bb:cc:dd:ee:ff'. Hosts cache replies without checking they asked, including unsolicited gratuitous ARP. An attacker forges replies mapping the gateway IP to its own MAC (and the victim's IP back to it), so both sides send their traffic through the attacker.

3. Attack (PoC)

netlab-arp attack --i-own-this-network --iface veth-host
  1. Gratuitous ARP to impersonate the gateway
  2. Bidirectional client<->gw MITM

4. Detection

netlab-arp detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Dynamic ARP Inspection backed by the DHCP binding
  • arpwatch, static entries

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading