ARP Spoofing (Also known as ARP Poisoning)

🛑 ARP Spoofing (Also known as ARP Poisoning)

ARP Spoofing is a man-in-the-middle (MITM) attack technique used by attackers on a local network to intercept, modify, or redirect traffic between two devices. It exploits the weaknesses in the Address Resolution Protocol (ARP), which is used to map IP addresses to MAC addresses on LANs.

🧠 How ARP Works (Briefly)

• Devices on a LAN use ARP to find the MAC address corresponding to an IP address.

• For example, a device will send an ARP request like:
  "Who has IP 192.168.1.1? Tell 192.168.1.100"

• The router (192.168.1.1) replies with its MAC address, and this is stored in the device’s ARP table.

⚠️ ARP Spoofing Attack Steps (Explained)

1. Configure IP Forwarding (Attacker’s Machine)

Before launching the attack, the attacker enables IP forwarding on their system. This allows them to pass network traffic between the victim and the real gateway (router), so the connection isn’t broken.

Linux Example Command:

echo 1 > /proc/sys/net/ipv4/ip_forward

2. Send Fake ARP Responses (Spoofing the Router)

The attacker sends forged ARP replies to the victim’s machine. These ARP packets falsely claim:

“192.168.1.1 (default gateway) is at [attacker’s MAC address]”

As a result, the victim updates its ARP table and associates the router’s IP with the attacker’s MAC address.

3. Victim Sends Internet-Bound Traffic to Attacker

The victim now believes the attacker is the gateway. Any traffic intended for the internet or other external networks is unknowingly sent to the attacker.

4. Sniff the Traffic

Since the attacker is now in the middle, they can:

• Capture usernames, passwords, session cookies

• Read or alter unencrypted traffic (HTTP, FTP, etc.)

• Use tools like Wireshark, Ettercap, or Bettercap to monitor or manipulate the data.

5. Forward Packets to Real Router (Avoid Detection)

To avoid breaking the network connection and raising suspicion, the attacker forwards the intercepted packets to the real default gateway. This keeps the victim online, making the attack stealthy.

So the attacker becomes a transparent proxy, observing everything while passing traffic both ways.

🧰 Tools Used in ARP Spoofing

• Ettercap

• Bettercap

• Arpspoof (Dsniff suite)

• Cain & Abel (Windows)

🛡️ Prevention & Detection

ARP Spoofing is a powerful yet simple attack used to perform man-in-the-middle attacks on local networks. While it doesn’t require much technical skill to launch, it can have severe consequences—especially on networks lacking basic security mechanisms.

Always secure local networks with proper segmentation, encryption, and monitoring to detect and prevent ARP-based attacks.