Address Resolution Protocol (ARP) resolves IP addresses into physical MAC addresses on local area networks (LAN). Because ARP does not require authentication, it is vulnerable to spoofing.
1. How ARP Spoofing Works
An attacker sends unsolicited ARP responses to the gateway router and the target victim machine:
- Tells the victim: “I am the gateway router (MAC address is mine).”
- Tells the router: “I am the victim machine (MAC address is mine).”
The victim’s network traffic is routed through the attacker’s device before reaching the gateway, allowing the attacker to inspect or modify all traffic.
2. Defensive Mitigations
- Use **Dynamic ARP Inspection (DAI)** on network switches to validate ARP mappings against DHCP database tables.
- Enforce static ARP tables for critical servers.