Sniffing · Module 08
ARP Spoofing
Poison ARP caches to intercept traffic on a LAN (man-in-the-middle).
Authorized use only. This tool can disrupt systems or intercept other people’s traffic. Use it strictly on an isolated lab you own (e.g. your Kali VM) or where you have explicit written permission.
Definition
ARP Spoofing (ARP poisoning) is a technique where an attacker sends falsified ARP messages on a local network.
Associate the attacker's MAC address with another host's IP (often the gateway), redirecting traffic through the attacker's machine.
Demonstrating man-in-the-middle (MITM) risk, testing segmentation and detection controls, and Layer 2 attack/defense training — only on networks you own or are explicitly authorized to test.
Key features
Enables MITM positioning to observe or manipulate traffic between two hosts.
Commonly targets the default gateway to intercept a victim's traffic.
Implemented by arpspoof (dsniff), Ettercap and Bettercap.
Often combined with Wireshark or tcpdump to capture redirected traffic.
Generates duplicate/gratuitous ARP replies that defensive tools can flag.
Important commands
arpspoof -i eth0 -t <victim-ip> <gateway-ip>Tell the victim the attacker is the gateway.
arpspoof -i eth0 -t <gateway-ip> <victim-ip>Tell the gateway the attacker is the victim.
echo 1 > /proc/sys/net/ipv4/ip_forwardEnable IP forwarding so traffic still reaches its destination.
ettercap -T -i eth0 -M arp:remote /<victim-ip>/ /<gateway-ip>/Launch an ARP MITM via Ettercap's text interface.
arp -aDisplay the local ARP table to check for spoofed entries (defensive).
arpwatch -i eth0Monitor ARP traffic and alert on changes (defensive).
Practical examples
echo 1 > /proc/sys/net/ipv4/ip_forward
Purpose Routes traffic onward so the victim's connection keeps working during the test.
arpspoof -i eth0 -t 192.168.1.20 192.168.1.1
Purpose In a lab, redirects the victim's gateway traffic through the attacker.
arp -a
Purpose A defender checks for one MAC mapped to multiple IPs — a sign of spoofing.
Important points
- Strictly authorized use only: Intercepting others' traffic is illegal without documented permission — practice only in isolated labs you own.
- Disruptive by nature: Misconfigured spoofing (e.g. forgetting IP forwarding) can cut off the victim's access.
- Layer 2 limitation: Only works within the same local segment/VLAN; it cannot cross routed networks.
- Defenses exist: Dynamic ARP Inspection (DAI), static ARP entries and port security prevent or detect it.
Common use cases
Check whether sensitive traffic is properly encrypted.
Test whether ARP inspection, IDS or monitoring detect spoofing.
Teach Layer 2 attack mechanics and the value of segmentation.
Help blue teams recognize ARP spoofing indicators.
This tool is taught in Module 08
Read the full written notes, with diagrams, defense and detection.