What Is ARP Spoofing?
On this page
ARP spoofing lets an attacker who is already on your local network quietly intercept traffic by lying about which device owns which address. ARP (Address Resolution Protocol) maps IP addresses to hardware MAC addresses on a LAN, and it trusts whatever it is told. By forging those mappings, an attacker inserts themselves into the flow — a textbook man-in-the-middle at the link layer.
How does it work?#
ARP has no authentication, so a malicious device can simply announce false mappings:
- The attacker sends forged ARP replies claiming their MAC owns the gateway’s IP.
- The victim’s device updates its ARP table and starts sending gateway-bound traffic to the attacker.
- The attacker (often spoofing both directions) relays the traffic, reading or altering it in transit.
Because ARP operates only within a local segment, the attacker must already be on the same network — which is exactly why network segmentation limits its reach.
How do you detect and defend?#
| Control | Effect |
|---|---|
| Dynamic ARP Inspection (DAI) | Switches drop forged ARP replies |
| Static ARP entries | Fixed mappings for critical hosts |
| Encryption (TLS) | Interception yields unreadable traffic |
| ARP monitoring | Alerts on suspicious mapping changes |
The strategic takeaway: assume the local network is hostile. Encryption ensures that even a successful ARP spoof captures only ciphertext.
ARP spoofing is a link-layer entry point to interception. More at the Network Security hub.
Frequently asked questions#
What is ARP spoofing?
ARP spoofing (or ARP poisoning) is a local-network attack where an attacker sends forged ARP messages associating their MAC address with another device’s IP — usually the gateway. Traffic meant for that device is then sent to the attacker instead, enabling interception, modification, or blocking of the victim’s traffic.
What can an attacker do with ARP spoofing?
By positioning themselves between a victim and the gateway, the attacker can read unencrypted traffic, attempt to strip or downgrade encryption, inject content, or drop packets. It is a classic enabler of man-in-the-middle attacks on a local network, which is why encryption like TLS matters even on "trusted" LANs.