What Is ARP Poisoning? How It Works & How to Defend Against It

ARP poisoning (also called ARP spoofing or ARP cache poisoning) is a Layer 2 man-in-the-middle attack that lets an attacker intercept, modify, or stop network traffic between two hosts on the same network. It exploits a fundamental weakness in the Address Resolution Protocol — there is no authentication.

How ARP works (and why it's vulnerable)

When a device wants to communicate with another device on the same subnet, it needs the target's MAC address. It sends an ARP request — a broadcast to every device asking "who has IP 192.168.1.1? Tell me your MAC." The target replies with a unicast ARP reply: "I have 192.168.1.1 — my MAC is AA:BB:CC:DD:EE:FF."

The requesting device stores this mapping in its ARP cache. Here's the critical weakness: any device can send an unsolicited ARP reply, and most operating systems will accept and cache it without question.

The attack step by step

An attacker on the same network segment (VLAN) as the victim can perform the attack as follows:

• Step 1 — Attacker sends a fake ARP reply to the victim, claiming: "I have the gateway's IP (192.168.1.1) — my MAC is DE:AD:BE:EF:CA:FE."
• Step 2 — Attacker sends a fake ARP reply to the gateway, claiming: "I have the victim's IP (192.168.1.10) — my MAC is DE:AD:BE:EF:CA:FE."
• Step 3 — Both victim and gateway update their ARP caches with the attacker's MAC address.
• Step 4 — All traffic between victim and gateway now flows through the attacker. The attacker forwards it on (so neither party notices), while reading or modifying it.

Victim ARP cache (poisoned):
  192.168.1.1  →  DE:AD:BE:EF:CA:FE  ← Attacker's MAC!

Gateway ARP cache (poisoned):
  192.168.1.10 →  DE:AD:BE:EF:CA:FE  ← Attacker's MAC!

What an attacker can do

• Credential theft — HTTP login forms, unencrypted FTP, Telnet sessions, and NTLM hashes pass through in plaintext
• Session hijacking — steal authenticated session cookies from HTTP traffic
• SSL stripping — downgrade HTTPS to HTTP on sites that don't enforce HSTS
• DNS spoofing — manipulate DNS responses to redirect traffic to fake sites
• Denial of service — drop traffic rather than forwarding it

Defences

Dynamic ARP Inspection (DAI)

DAI is a Cisco IOS feature (and equivalent on other vendors) that validates ARP packets against the DHCP snooping binding table. Ports are classified as trusted (uplinks) or untrusted (end-user ports). An ARP reply arriving on an untrusted port is dropped if the IP-to-MAC mapping doesn't match the binding table.

ip dhcp snooping
ip dhcp snooping vlan 10
ip arp inspection vlan 10
!
interface GigabitEthernet0/1
 ip dhcp snooping limit rate 15
 ip arp inspection limit rate 100

Static ARP entries

For critical devices (gateway, servers), you can add static ARP entries that cannot be overwritten by gratuitous ARP replies. Manageable for a handful of devices, impractical at scale.

Encrypted protocols

HTTPS, SSH, and VPN tunnels mean that even if an attacker intercepts your traffic, they see only ciphertext. This doesn't stop the attack but limits the damage severely. Always verify the certificate is valid — SSL stripping can still be attempted.

Network segmentation and 802.1X

ARP poisoning only works within a broadcast domain. Proper VLAN segmentation limits the blast radius — an attacker on the guest VLAN cannot reach the corporate VLAN. 802.1X port authentication prevents untrusted devices from joining the network in the first place.