ARP Spoofing

ARP has no authentication, so an attacker can send forged replies claiming the gateway’s IP maps to their own MAC address. Victim machines update their ARP tables and start sending traffic through the attacker first. It’s the classic on-ramp for man-in-the-middle positioning, and it’s what makes DNS spoofing and LLMNR/NBT-NS relay practical on a switched network.

How It Works

The attacker sends gratuitous ARP replies to the victim and the gateway, poisoning both so traffic flows through the attacker in each direction. Tools like ettercap and bettercap automate this, then sniff, downgrade, or relay the intercepted traffic. From there, session tokens and credentials in cleartext protocols are simply captured off the wire.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

How to Detect It

• Alert when several IPs map to a single MAC address on the LAN.
• Watch for the gateway’s MAC address changing unexpectedly.
• Flag a flood of gratuitous ARP replies, and use IDS rules built for ARP anomalies.

How to Defend Against It

• Enable Dynamic ARP Inspection and DHCP snooping on managed switches.
• Pin static ARP entries for critical hosts like the default gateway.
• Enforce port security and 802.1X for network access control, and encrypt traffic end to end so an intercepted stream is useless.

Validating Your Defenses

An authorized test shows whether ARP poisoning still succeeds against your switches and whether the resulting traffic can actually be read or relayed. Record every poisoned host and intercepted session so it lands in the pentest report as evidence, not a screen capture you’ll lose.