Lesson 2.37: Catching ARP spoofing on the LAN
Inside a VLAN, machines find each other's hardware (MAC) addresses with ARP, and ARP has no authentication: anyone can announce 'the router is me'. An attacker who does that sits between victims and their gateway (a man-in-the-middle) and can read or change unencrypted traffic. In the lab you notice that two addresses in a finance workstation's ARP cache share one MAC, see the forged replies in a capture, trace the device to a switch port, and prepare the switch change: shut the port, then turn on DHCP snooping and Dynamic ARP Inspection.
15 min
You will learn to
- Explain ARP and why it can be spoofed
- Read the ARP cache with ip neigh
- Recognise forged ARP replies in a capture
- Trace a MAC address to a switch port
- Describe DHCP snooping and Dynamic ARP Inspection
Key terms
- ARP
- Address Resolution Protocol: finds the MAC address for an IPv4 address on the local network.
- ARP cache
- A host's table of IP-to-MAC mappings it learned.
- ARP spoofing / poisoning
- Sending forged ARP replies to redirect traffic through the attacker.
- Man-in-the-middle (MITM)
- An attacker relaying traffic between two parties who think they talk directly.
- DHCP snooping
- A switch feature that allows DHCP answers only from trusted ports and records IP-MAC-port bindings.
- Dynamic ARP Inspection (DAI)
- Drops ARP packets that don't match the DHCP snooping bindings.
← IPv4 addresses, binary and the subnet mask · All lessons · SUID programs and baselines →