Skip to content
Search

ARP Spoofing

lastmod 2018-08-17created 2014-07-106 edits

ARP spoofing is a man-in-the-middle attack technique that intercepts another party's data packets in transit by using Address Resolution Protocol (ARP) messages on a local area network (LAN). Because this attack exploits ARP, a protocol on the data link layer, it can only be used for communication within a local network.

Attacks using this technique rarely produce noticeable symptoms, so unless users use special tools, it is hard for them to tell that they are being attacked.

ARP Spoofing exploits a weakness in ARP to disguise the attacker's own MAC (Media Access Control) address as the MAC of another computer. Because the ARP Spoofing attack arbitrarily alters ARP Cache information, it is also called an 'ARP Cache Poisoning attack'. Put simply, the attacker poses as the Gateway and monitors the packets between the user and the server.

On a local area network, the mapping between each device's IP address and MAC address is done through the ARP protocol. If an attacker deliberately sends an ARP message mapping a particular IP address to the attacker's own MAC address, the device that receives the message recognizes that IP address as the attacker's MAC address and sends packets meant for that IP address to the attacker. The attacker can then tamper with those packets at will and forward them to the original destination MAC address. A common attack method is to spoof the gateway IP, in which case every packet sent outside can be intercepted or tampered with by the attacker. Another frequently used technique is to ARP-spoof two nodes separately and manipulate the communication between the two devices in the middle.

See also

Favorite site

References

  1. Asec_report_2007_06_arp_spoofing.pdf ↩

sitemap