ARP and Layer 2 Attacks — The LAN Battleground

#ARP and Layer 2 Attacks — The LAN Battleground#link

ARP — the Address Resolution Protocol — is one of the most exploited protocols in networking. It operates at the boundary between Layer 2 and Layer 3, and it was designed in an era of trust. There is no authentication, no verification, and no built-in security. This makes it the perfect target for man-in-the-middle attacks on local networks. In this lesson, you will learn how ARP works and how attackers abuse it.

How ARP Works

When a device needs to send an IP packet to another device on the same local network, it needs the destination's MAC address. ARP resolves IP addresses to MAC addresses through a simple request-reply mechanism.

ARP Resolution Process:

Host A (192.168.1.10) wants to send to Host B (192.168.1.20)

1. Host A checks its ARP cache → No entry for 192.168.1.20
2. Host A broadcasts ARP Request:
   "Who has 192.168.1.20? Tell 192.168.1.10"
   (Sent to MAC ff:ff:ff:ff:ff:ff — all devices on segment)

3. Host B receives the broadcast and responds:
   "192.168.1.20 is at AA:BB:CC:DD:EE:FF"
   (Sent directly to Host A's MAC address)

4. Host A caches the mapping and sends the frame

The ARP Spoofing Attack

ARP spoofing (also called ARP poisoning) exploits the fact that ARP has no authentication. An attacker sends gratuitous ARP replies — unsolicited responses that claim the attacker's MAC address corresponds to a legitimate IP address. Other devices on the network update their ARP caches with the false mapping, and traffic is redirected through the attacker's machine.

ARP Spoofing (Man-in-the-Middle):

Normal Traffic Flow:
  Victim (192.168.1.10) ──────────────> Gateway (192.168.1.1)

After ARP Spoofing:
  Victim ──> Attacker (fake gateway) ──> Gateway
  Gateway ──> Attacker (fake victim) ──> Victim

Attacker sends:
  To Victim: "192.168.1.1 is at [Attacker's MAC]"
  To Gateway: "192.168.1.10 is at [Attacker's MAC]"

Now all traffic flows through the attacker, who can:
  - Read unencrypted traffic (passwords, cookies)
  - Modify traffic in transit
  - Inject malicious content

Performing ARP Spoofing with arpspoof

The classic tool for ARP spoofing is arpspoof from the dsniff package. Here is how it works in practice. First, you must enable IP forwarding on your attack machine so traffic flows through you instead of being dropped:

Detecting and Preventing ARP Spoofing

As a security professional, you also need to know how to detect and prevent ARP spoofing. This is critical for the defense side of your skill set.