🎭 03-04: ARP Spoofing Attacks¶

📌 Definition¶

ARP spoofing (also called ARP cache poisoning or ARP poisoning) is an attack where a malicious host sends forged ARP replies onto a LAN, tricking other devices into associating the attacker's MAC address with an IP address that isn't actually theirs.

👉 As a result:

Traffic meant for the real owner of that IP gets sent to the attacker instead
The attacker can silently read, modify, or drop that traffic
All of this happens without the victim noticing anything wrong — no error, no dropped connection, nothing

This attack is only possible because of the trust problem covered in 03-03: ARP Protocol Recap: ARP replies are accepted with no authentication at all.

🧠 The Core Idea¶

Normal Flow¶

Victim → ARP cache says Gateway is at real-router-MAC → Victim sends traffic to real router

After ARP Spoofing¶

Victim → ARP cache poisoned: "Gateway is at attacker-MAC" → Victim sends traffic to attacker

💥 The victim's own machine now willingly routes its traffic through the attacker — it has no way of knowing its ARP cache is lying to it.

🧩 Step-by-Step: How the Attack Works¶

Let's say the attacker wants to intercept traffic between a Victim (192.168.1.10) and the Gateway/router (192.168.1.1), on a LAN where the attacker's machine is 192.168.1.66.

Step 1: Attacker sends a forged ARP reply to the Victim¶

"192.168.1.1 (the gateway) is at ATTACKER-MAC"

The Victim updates its ARP cache, now believing the gateway's MAC address is actually the attacker's.

Step 2: Attacker sends a forged ARP reply to the Gateway¶

"192.168.1.10 (the victim) is at ATTACKER-MAC"

The Gateway updates its ARP cache too, now believing the victim's MAC address is the attacker's.

Step 3: The attacker is now "in the middle"¶

Victim → sends traffic addressed to the Gateway's IP, but at Layer 2 it goes to the attacker's MAC
Gateway → sends return traffic addressed to the Victim's IP, but at Layer 2 it goes to the attacker's MAC

Step 4: The attacker forwards traffic (to stay invisible)¶

If the attacker just intercepts and does nothing else, the victim's internet connection appears to break entirely — a dead giveaway. So a competent attacker enables IP forwarding on their own machine and relays every packet on to its real destination after inspecting (or modifying) it.

Victim ⇄ Attacker ⇄ Gateway ⇄ Internet
        (attacker silently relays both directions)

This is called ARP-based Man-in-the-Middle (MITM) positioning — the general MITM concept is covered fully in 03-05: MITM Attacks & Defenses.

💡 Both directions matter. Poisoning only the victim intercepts outbound traffic; poisoning only the gateway intercepts inbound traffic. Poisoning both gives the attacker a full two-way view of the conversation.

🖼️ Realistic Attack Scenario¶

Imagine a coffee shop's shared Wi-Fi network:

An attacker connects to the same Wi-Fi as everyone else — no special access needed, just being on the same LAN/broadcast domain.
The attacker runs an ARP spoofing tool targeting a specific victim's laptop and the Wi-Fi router.
Within seconds, the victim's laptop and the router both have poisoned ARP caches pointing to the attacker.
All of the victim's traffic — web browsing, app traffic, DNS queries — now physically flows through the attacker's laptop before reaching the router.
The attacker runs a sniffer (see 03-02: Sniffing Tools (Scapy/tcpdump)) to capture anything unencrypted: HTTP logins, plaintext chat, session cookies.
The victim continues browsing normally, completely unaware anything is wrong, since the attacker is faithfully forwarding their traffic along.

This scenario is exactly why public Wi-Fi is considered a risky network to do sensitive activity on without a VPN or reliance on HTTPS.

🛠️ Tools That Perform ARP Spoofing¶

Tool	Description
arpspoof (part of the `dsniff` suite)	A simple command-line tool purpose-built for ARP poisoning
ettercap	A full MITM framework with ARP poisoning, sniffing, and even live traffic filtering/injection built in, plus a graphical interface
Bettercap	A more modern, actively maintained successor to Ettercap with a scriptable interface
Scapy	Can construct and send raw forged ARP replies manually, for a fully custom/educational implementation

Example: arpspoof¶

# Poison the victim (192.168.1.10), telling it we are the gateway (192.168.1.1)
sudo arpspoof -i eth0 -t 192.168.1.10 192.168.1.1

# Poison the gateway too, telling it we are the victim
sudo arpspoof -i eth0 -t 192.168.1.1 192.168.1.10

Conceptual Scapy Version¶

from scapy.all import ARP, send

# Tell the victim (192.168.1.10) that the gateway's IP is at our MAC
poison_victim = ARP(
    op=2,                          # op=2 means "is-at" (an ARP reply)
    pdst="192.168.1.10",           # who we're sending the lie to
    psrc="192.168.1.1",            # the IP we're impersonating (the gateway)
)
send(poison_victim, verbose=0)

💡 Notice this needs no destination MAC lookup or handshake at all — the attacker just broadcasts (or unicasts) an ARP reply out of nowhere, and it works because nothing checks whether it was solicited.

⚠️ Don't forget: for the attack to be useful rather than just a denial-of-service, the attacker's machine must also enable IP forwarding (e.g., echo 1 > /proc/sys/net/ipv4/ip_forward on Linux) so traffic keeps flowing.

🛡️ Defenses Against ARP Spoofing¶

Defense	How it helps
Static ARP entries	Manually configuring permanent, unchangeable IP-to-MAC mappings for critical hosts (like the default gateway) means forged replies are simply ignored. Doesn't scale well to large/dynamic networks.
Dynamic ARP Inspection (DAI)	A switch-level feature that validates ARP packets against a trusted binding table (often built from DHCP snooping records) and drops ARP replies that don't match a known, legitimate IP-to-MAC pairing.
Port security	Restricting how many/which MAC addresses are allowed on a given switch port, making it harder for an attacker to spoof arbitrary addresses.
ARP spoofing detection tools	Tools like `arpwatch` or `XArp` monitor for suspicious ARP activity — e.g., the same IP suddenly claiming a new MAC address — and alert administrators.
VLAN segmentation	Since ARP poisoning only works within the same broadcast domain, splitting a network into smaller VLANs limits the blast radius of any single compromised or malicious host.
Encryption (TLS/HTTPS, VPNs)	Doesn't stop the poisoning itself, but makes intercepted traffic unreadable/untamperable, neutralizing the payoff of the attack.

💡 In practice, encryption is the most reliable mitigation for end users, since ARP-layer defenses require cooperation from network administrators and infrastructure the average user doesn't control.

📌 Key Takeaways¶

ARP spoofing exploits ARP's complete lack of authentication by sending forged ARP replies that lie about IP-to-MAC mappings.
A full MITM position requires poisoning both the victim and the gateway (or the other endpoint of a conversation).
Once poisoned, victims send their traffic straight to the attacker's machine without any indication anything is wrong.
The attacker must enable IP forwarding to relay traffic transparently — otherwise the attack is obvious (connectivity breaks).
Common tools include arpspoof, ettercap, Bettercap, and custom Scapy scripts.
Defenses range from host/switch-level controls (static ARP entries, Dynamic ARP Inspection, port security, VLAN segmentation) to detection tools (arpwatch) and, most reliably for end users, encryption.
ARP spoofing is one of the most common ways to achieve a general Man-in-the-Middle position — covered next in 03-05: MITM Attacks & Defenses.