ARP Poisoning: A Comprehensive Guide
ARP (Address Resolution Protocol) poisoning, also known as ARP spoofing
or ARP cache poisoning, is a network attack that allows an attacker to
intercept, modify, or block communications between devices on a local
network.
How ARP Works (Normally)
1. Purpose: ARP resolves IP addresses to MAC addresses on local networks
2. Process:
o Host A wants to communicate with Host B (IP known, MAC unknown)
o Host A broadcasts an ARP request: "Who has IP X.X.X.X?"
o Host B responds with its MAC address
o Host A stores this mapping in its ARP cache
ARP Poisoning Explained
The Attack Mechanism
An attacker sends falsified ARP messages to:
Associate their MAC address with the IP of another host (like the default
gateway)
Redirect traffic through their machine
Types of ARP Poisoning
1. Host Poisoning: Redirect traffic between two specific hosts
2. Gateway Poisoning: Redirect all traffic going to/from the gateway
Performing ARP Poisoning
Common tools used:
arpspoof (part of dsniff suite)
Ettercap
Cain & Abel (Windows)
BetterCAP
Basic command example with arpspoof:
bash
Copy
arpspoof -i eth0 -t 192.168.1.100 192.168.1.1
(This tells 192.168.1.100 that the attacker's MAC is for 192.168.1.1)
Attack Scenarios
1. Man-in-the-Middle (MITM): Intercept and potentially modify
communications
2. Session Hijacking: Take over existing sessions
3. Denial of Service: Cause network disruption
4. Data Interception: Capture sensitive information (passwords, emails,
etc.)
Detection Methods
Signs of ARP poisoning:
Unusual ARP traffic
Duplicate IP addresses detected
Unexpected MAC address changes
Network performance issues
Detection tools:
arpwatch - Monitors ARP changes
XArp - Graphical ARP monitoring
Wireshark - Analyze ARP traffic
Prevention and Mitigation
1. Static ARP entries: Manually configure important ARP mappings
bash
Copy
arp -s 192.168.1.1 00:11:22:33:44:55
2. ARP inspection:
o Cisco's Dynamic ARP Inspection (DAI)
o ARP-Guard solutions
3. Network segmentation: Use VLANs to limit broadcast domains
4. Encryption: Use HTTPS, SSH, VPNs to protect data even if intercepted
5. Port security: Configure switches to allow only specific MACs on ports
Ethical Considerations
ARP poisoning is illegal without proper authorization
Should only be performed on networks you own or have explicit
permission to test
Many organizations consider ARP poisoning a violation of their security
policies
Practical Defense Example
For Linux systems, you can add a cron job to periodically check ARP
tables:
bash
Copy
#!/bin/bash
GATEWAY_IP="192.168.1.1"
EXPECTED_MAC="00:11:22:33:44:55"
CURRENT_MAC=$(arp -n $GATEWAY_IP | awk '{print $3}')
if [ "$CURRENT_MAC" != "$EXPECTED_MAC" ]; then
echo "ARP poisoning detected!" | mail -s "Security Alert"
[email protected] arp -s $GATEWAY_IP $EXPECTED_MAC
fi
