iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
ARP cache poisoning is an attack that puts a false IP-to-MAC address mapping into a device’s local network cache. If the device accepts it, traffic intended for another local device can be redirected through the attacker, creating an opportunity to intercept or alter traffic. The attack affects a local network segment; it does not rewrite arbitrary Internet routing.
What ARP cache poisoning means
On an IPv4 local network, the Address Resolution Protocol (ARP) helps a device find the Ethernet MAC address associated with an IPv4 address. Devices keep these IP-to-MAC mappings in an ARP cache so they can send subsequent frames without asking again each time. Cisco defines the attack simply: “Sending false information to an ARP cache is known as ARP cache poisoning.” Cisco’s explanation of ARP spoofing attacks describes the mechanism; MITRE ATT&CK technique T1557.002 notes that ARP is stateless and has no built-in authentication, so a device may accept an incorrect mapping.
The underlying protocol is specified in RFC 826. In practical terms, poisoning occurs when a false mapping is accepted into the cache—not merely when a forged ARP message is sent.
How ARP spoofing redirects traffic
- A device needs to send traffic to an IPv4 address on its local network and broadcasts an ARP request to learn the corresponding MAC address.
- An attacker sends a forged ARP response or gratuitous ARP message claiming that the target IP address belongs to the attacker’s MAC address.
- If the receiving device accepts the claim, it stores the false binding and sends frames for that IP address to the attacker’s device.
- The attacker may forward the traffic to its intended destination. When the attacker also poisons the other communicating device’s cache, traffic can pass through the attacker in both directions, creating a man-in-the-middle position.
Cisco documents an example in which forged bindings poison the caches of two communicating hosts and a switch in the scenario. The exact devices affected depend on the network and on which systems accept the forged messages.
#1 Best Overall
What an attacker can—and cannot—do with it
Traffic redirected through an attacker may be intercepted, and the position can support follow-on sniffing or manipulation of transmitted data. The outcome depends on which devices accept the false mapping, whether the attacker forwards traffic, and what protections are in place.
Redirection does not automatically reveal the contents of encrypted sessions. Encryption can limit what an interceptor can read, but it does not itself prevent the false mapping, stop traffic from being redirected, or rule out every form of manipulation. ARP poisoning in this scenario is a Layer 2, local-network attack against devices in the same subnet or broadcast domain—not a method for changing arbitrary Internet routing tables.
How to reduce the risk
| Defense | What it does | Operational considerations |
|---|---|---|
| Dynamic ARP Inspection (DAI) | Validates ARP packets and can drop invalid ones on supported switches when enabled and configured correctly. | Check the actual switch platform and configuration requirements. DAI is a switch capability, not a universal setting available on every device. |
| DHCP snooping with binding validation | Can provide IP/MAC-to-switch-port bindings for DAI to use when identifying bogus ARP traffic. | Depends on a suitable managed-switch environment and trustworthy DHCP-derived bindings. |
| Encryption | Limits the usefulness of intercepted traffic by protecting sensitive information. | It reduces exposure of content; it does not prevent redirection or all traffic manipulation. |
| Static ARP entries | Can prevent a device from relying on a dynamically learned mapping for configured peers. | May be impractical to create and maintain across a large network. |
| Network intrusion prevention and traffic filtering | Can help identify or restrict suspicious network activity. | Needs to fit the network’s topology and monitoring capabilities. |
MITRE lists DHCP snooping with DAI, encryption, static entries, network intrusion prevention, and traffic filtering among possible mitigations. Cisco’s IOS XE 17.18.1 Dynamic ARP Inspection guide explains DAI’s packet-validation behavior. These sources do not establish a universal ranking or a quantitative cost-effectiveness comparison; the right controls depend on the network’s size, equipment, and configuration.
Recommended Free Tools
Choosing a defense for your network
For an organization operating its own Layer 2 network, first determine whether its switches support DAI and whether the network can supply reliable DHCP snooping bindings. Then weigh that switch-level control against the administrative burden of static entries and the broader value of encryption, filtering, and intrusion prevention. A managed switch that supports DAI may be relevant for this use case, but support varies by platform and should be confirmed against the manufacturer’s documentation before implementation. Individual users generally cannot enable DAI on a home router or endpoint unless the relevant equipment provides and exposes that capability.
Quick Recap
Best Value
- Used Book in Good Condition
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
