ARP spoofing/poisoning (IPv4)¶

Attack pattern¶

ARP is how a machine finds the MAC address behind an IP on the local segment: it asks “who has this IP?” and believes whoever answers. Nothing checks the reply, and most hosts will take one they never asked for. Send forged replies and the neighbours’ caches fill with the attacker’s MAC for the gateway, or for each other, so traffic that should have gone straight now goes through the attacker first, to be read, changed or dropped.

1. ARP Spoofing/Poisoning [OR]

    1.1 Man-in-the-Middle (MitM) Attacks [OR]
    
        1.1.1 Gateway Impersonation
            1.1.1.1 Spoofing the MAC address of the default gateway
            1.1.1.2 Gratuitous ARP replies announcing the attacker as gateway
            1.1.1.3 Persistent ARP cache poisoning
            
        1.1.2 Host Impersonation
            1.1.2.1 Spoofing the MAC address of specific target hosts
            1.1.2.2 ARP starvation attacks followed by impersonation
            1.1.2.3 DHCP spoofing combined with ARP poisoning
            
    1.2 Denial-of-Service (DoS) [OR]
    
        1.2.1 ARP Cache Poisoning
            1.2.1.1 Flooding with spoofed ARP replies
            1.2.1.2 Invalid MAC address assignments
            1.2.1.3 Redirecting traffic to non-existent hosts
            
        1.2.2 ARP Table Overflow
            1.2.2.1 Flooding switches with fake ARP entries
            1.2.2.2 CAM table exhaustion attacks
            1.2.2.3 Switch performance degradation
            
    1.3 Session Hijacking [OR]
    
        1.3.1 TCP Session Stealing
            1.3.1.1 Active session takeover
            1.3.1.2 Sequence number prediction
            1.3.1.3 RST injection attacks
            
        1.3.2 Application Layer Attacks
            1.3.2.1 HTTP session cookie theft
            1.3.2.2 SSL/TLS stripping attacks
            1.3.2.3 DNS spoofing through ARP poisoning
            
    1.4 VLAN Hopping [OR]
    
        1.4.1 Cross-VLAN Attacks
            1.4.1.1 Double tagging attacks
            1.4.1.2 Switch spoofing attacks
            1.4.1.3 ARP poisoning across VLAN boundaries
            
    1.5 IPv6 Neighbor Discovery Protocol (NDP) Attacks [OR]
    
        1.5.1 Neighbor Advertisement Spoofing
            1.5.1.1 IPv6 address takeover
            1.5.1.2 Router advertisement spoofing
            1.5.1.3 Redirect attacks
            
        1.5.2 Duplicate Address Detection (DAD) Attacks
            1.5.2.1 Address assignment prevention
            1.5.2.2 DoS through fake address conflicts
            
    1.6 Advanced Persistence [OR]
    
        1.6.1 Stealthy ARP Poisoning
            1.6.1.1 Low-rate poisoning attacks
            1.6.1.2 Timing-based evasion
            1.6.1.3 Selective target poisoning
            
        1.6.2 Persistent ARP Manipulation
            1.6.2.1 Scheduled ARP attacks
            1.6.2.2 Automated re-poisoning scripts
            1.6.2.3 Multi-vector ARP attacks
            
    1.7 Wireless Network Attacks [OR]
    
        1.7.1 WiFi ARP Poisoning
            1.7.1.1 Rogue access point attacks
            1.7.1.2 Evil twin attacks
            1.7.1.3 EAPOL attack combinations
            
        1.7.2 Bluetooth ARP-like Attacks
            1.7.2.1 L2CAP spoofing attacks
            1.7.2.2 BNEP manipulation attacks
            
    1.8 Industrial Control Systems (ICS) [OR]
    
        1.8.1 SCADA Network Attacks
            1.8.1.1 Modbus/TCP ARP poisoning
            1.8.1.2 PROFINET ARP manipulation
            1.8.1.3 DNP3 session hijacking
            
    1.9 Cloud and Virtual [OR]
    
        1.9.1 Hypervisor ARP Attacks
            1.9.1.1 Virtual switch ARP poisoning
            1.9.1.2 VM-to-VM ARP spoofing
            1.9.1.3 Container network ARP manipulation
            
        1.9.2 Cloud Network Attacks
            1.9.2.1 VPC ARP spoofing attacks
            1.9.2.2 Cloud load balancer poisoning
            1.9.2.3 SDN controller ARP manipulation

Any answer will do¶

ARP has no authentication: a host trusts an ARP reply without checking who sent it.
Requests are broadcast to the whole segment, so an attacker sees them and can race to answer.
Most systems update their cache from any reply, requested or not (gratuitous ARP), so unsolicited forgeries stick.
ARP is simple by design, with no security built in to bypass in the first place.
It all happens at layer 2, beneath the IP-based controls that most monitoring watches.