ARP Spoofing (also called ARP cache poisoning or ARP poisoning) is a network attack where an attacker sends falsified ARP (Address Resolution Protocol) messages over a local network. The attacker associates their MAC address with the IP address of another device (e.g., gateway, router). This causes network traffic destined for that IP address to be redirected to the attacker instead. ARP spoofing enables Man-in-the-Middle (MitM) attacks, allowing the attacker to intercept, modify, or block data in transit, capture credentials (HTTP, FTP, Telnet), downgrade HTTPS (SSLStrip), and inject malicious content.
Attack Prevalence: ARP spoofing affects 40% of enterprise networks annually (2023). Public Wi-Fi networks (coffee shops, airports, hotels) are most vulnerable (70% of ARP spoofing attacks).
Common targets of ARP spoofing attacks:
Victim sends ARP request: "Who has IP 192.168.1.1? Tell 192.168.1.105."
Attacker sends unsolicited ARP reply: "192.168.1.1 is at MAC:AA:BB:CC:DD:EE:FF" (attacker MAC).
Victim's ARP cache updates: Gateway IP → Attacker MAC.
Victim sends all outbound traffic to attacker (believes attacker is gateway).
// ARP spoofing attack chain (technical flow)
[Victim 192.168.1.105] → [Attacker 192.168.1.50] ← [Gateway 192.168.1.1]
1. Victim ARP cache (normal):
192.168.1.1 → MAC:GG:GG:GG:GG:GG:GG (gateway)
2. Attacker sends gratuitous ARP reply:
"192.168.1.1 is at MAC:AA:BB:CC:DD:EE:FF" (attacker MAC)
3. Victim ARP cache (poisoned):
192.168.1.1 → MAC:AA:BB:CC:DD:EE:FF (attacker)
4. Victim internet traffic (HTTP, HTTPS, FTP, DNS) → Attacker
5. Attacker forwards traffic → Real gateway
6. Attacker can:
- Sniff plaintext passwords (HTTP, FTP, Telnet)
- Modify data in transit
- Perform SSLStrip (HTTPS downgrade)
- Inject malicious JavaScript (malware)
// ARP spoofing with ettercap
sudo ettercap -T -M arp:remote /192.168.1.105// /192.168.1.1//
// ARP spoofing with bettercap
sudo bettercap -eval "set arp.spoof.targets 192.168.1.105; arp.spoof on; net.sniff on"
Attacker poisons both victim and gateway: Victim's ARP maps gateway to attacker MAC, gateway's ARP maps victim to attacker MAC. All traffic flows through attacker. Allows interception, modification, and injection.
Attacker only poisons victim's ARP cache (gateway IP → attacker MAC). Outbound traffic intercepted, but return traffic may not go through attacker.
Attacker sends ARP replies with nonexistent MAC address (00:00:00:00:00:00). Victim's ARP cache invalid → traffic blackholed (denial of service).
Comprehensive MitM tool with ARP spoofing module. Supports both CLI (ettercap -T) and GUI (ettercap -G). Features: ARP poisoning, DNS spoofing, packet filtering (etterfilter), and real-time packet injection.
Modern network attack framework. ARP spoofing module: arp.spoof on. Features: HTTPS proxy, credential harvesting, packet sniffer, and REST API.
Legacy ARP spoofing tool (dsniff suite). Command: arpspoof -i eth0 -t 192.168.1.105 192.168.1.1. Requires IP forwarding enabled.
This demonstration simulates ARP spoofing, poisoning the victim's ARP cache to intercept traffic:
This is a simulated demonstration. Real ARP spoofing can intercept passwords, emails, and sensitive data on local networks. Protect yourself by using VPN on public Wi-Fi, enabling ARP spoofing detection (ARPwatch, XArp), and using HTTPS with HSTS (HTTP Strict Transport Security).
ARPwatch monitors ARP table changes and alerts when MAC address changes for IP address. Detects ARP spoofing (same IP, different MAC). Command: arpwatch -i eth0.
Cisco switch feature that validates ARP packets against DHCP snooping database. Blocks ARP spoofing at network level.
ARP spoofing detection tool for Windows/Linux. Uses passive and active detection methods.
Configure static ARP entries for critical IPs (gateway). Prevents ARP cache poisoning. Windows: arp -s 192.168.1.1 00-11-22-33-44-55. Linux: arp -s 192.168.1.1 -i eth0 00:11:22:33:44:55.
VPN encrypts all traffic (including ARP-protected traffic) between device and VPN server. Prevents MitM even if ARP spoofed.
Switch-based protection. Validates ARP packets against DHCP snooping database. Blocks ARP spoofing at network infrastructure level.
Best Practice - Defense-in-Depth: Use VPN on public Wi-Fi (encrypts traffic), enable DAI on switches (network-level protection), monitor ARP tables (ARPwatch), and use static ARP entries for critical IPs (gateway).
ARP spoofing (unauthorized network interception) is illegal in all jurisdictions:
ARP spoofing is illegal and unethical. Penalties include:
Important: This guide is for educational and defensive purposes only. Unauthorized ARP spoofing is illegal.
ARPwatch monitors ARP table changes and detects ARP spoofing.
ARP spoofing detection tool with GUI (Windows/Linux).
Cisco switch feature blocking ARP spoofing.