ARP spoofing allows an attacker to position themselves between two devices on a local network by poisoning the ARP tables. ARP (Address Resolution Protocol) maps IP addresses to MAC addresses. Because ARP lacks authentication, attackers can send forged ARP replies, tricking victims into sending traffic to the attacker instead of the intended destination. This enables traffic interception, manipulation, and credential harvesting.

How ARP Works

Devices use ARP to resolve an IP address to a MAC address.
When a device needs the MAC for an IP, it broadcasts an ARP request.
Whichever host claims the IP replies with its MAC address.
Because ARP has no verification, any device can claim any IP.

ARP spoofing abuses this by sending fake ARP replies that associate:

• Attacker’s MAC → Victim’s IP

• Attacker’s MAC → Gateway’s IP

This forces traffic through the attacker.

Identifying Network Targets

Before spoofing, pentesters identify the gateway and available hosts on the LAN.

Discovering Live Hosts

sudo arp-scan -l

Checking Existing ARP Table

arp -a

These steps reveal potential victims and the default gateway.

Performing ARP Spoofing

ARP spoofing sends forged ARP packets to victims and the gateway.

Using arpspoof

Spoof victim:

sudo arpspoof -t 10.10.10.5 10.10.10.1

Spoof gateway:

sudo arpspoof -t 10.10.10.1 10.10.10.5

Traffic between victim and gateway now flows through the attacker.

Enabling Packet Forwarding

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

Without forwarding, the victim loses network access.

Capturing Intercepted Traffic

With ARP spoofing active, pentesters capture traffic to identify unencrypted credentials, cookies, or sensitive information.

Using tcpdump

sudo tcpdump -i eth0 host 10.10.10.5

Using Wireshark

Wireshark automatically collects packets once ARP spoofing is active.

MITM traffic includes HTTP requests, DNS queries, and other unencrypted protocols.

Detecting HTTPS Traffic

Even though HTTPS is encrypted, ARP spoofing still enables:

• SNI identification

• Certificate inspection

• Traffic pattern analysis

Encrypted content cannot be read without additional SSL attacks.

Performing DNS Spoofing After ARP Spoofing

DNS spoofing redirects victims to malicious or controlled servers.

Using dnsspoof

sudo dnsspoof -i eth0

This allows redirecting domains to attacker-hosted IPs.

Using Ettercap for Automated MITM

Ettercap automates ARP poisoning and packet inspection.

Starting Ettercap

sudo ettercap -T -M arp /10.10.10.5/ /10.10.10.1/

Ettercap can detect:

• Passwords

• Form submissions

• Plaintext protocols

Its plugins provide additional MITM features.

Defense Indicators

During testing, pentesters observe whether the network has:

• Dynamic ARP inspection

• Static ARP entries

• Port security enabled

• ARP spoofing detection tools

Networks lacking protections are highly vulnerable.

Why ARP Spoofing Matters

ARP spoofing exposes weaknesses in LAN security. It enables interception of sensitive traffic, credential theft, session hijacking, and testing network defenses. MITM attacks through ARP spoofing are fundamental techniques in network pentesting and help evaluate internal security posture.

Intel Dump

• ARP spoofing redirects traffic by poisoning ARP caches

• Tools include arpspoof, arp-scan, tcpdump, Wireshark, dnsspoof, Ettercap

• Forwarding must be enabled for MITM

• ARP spoofing enables DNS spoofing and credential interception

• Lack of ARP protections exposes networks to MITM attacks