Manipulating network traffic to intercept, redirect, or disrupt communications

Introduction

IT networks rely on several protocols working together to allow devices to communicate. One of these protocols is the Address Resolution Protocol (ARP).

ARP is used on IPv4 networks to associate an IP address with a device’s MAC address.

For example, a device may know that it needs to communicate with another device who’s IP address is 192.168.1.20.

In order to do this, it needs to generate an Ethernet frame into which it can place the communication data for transmission over the network. Ethernet communications require a source and destination MAC address.

To obtain the MAC address of the destination device, ARP is used.

The sending device transmits an ARP broadcast over the network asking for the MAC address of the device which currently has the IP address 192.168.1.20.

Every device in the local network receives the broadcast, but only the device with the corresponding IP address will (should) reply.

As such ARP allows the computer to discover the MAC address of the machine with the specified MAC address – E.G. 192.168.1.20 → AA:BB:CC:DD:EE:FF

Under normal circumstances, this process happens automatically and transparently – the user never sees this process happening.

For a full breakdown of the ARP protocol – see my tech explainer on this topic

However, ARP has an important weakness – Traditional ARP does not provide strong authentication of ARP messages. This means that an attacker on the same local network can attempt to send false ARP information to other devices.

This technique is known as ARP Poisoning, also called ARP Spoofing.

If successful, an attacker may be able to position themselves between two communicating devices, redirect traffic, intercept communications, or disrupt network connectivity.

What is ARP Poisoning?

ARP Poisoning is an technique in which an attacker sends fraudulent ARP information to associate their own MAC address with another device’s IP address.

The attacker attempts to corrupt the ARP cache of another device.

In the diagram above, the victim wants to send data to the Router, so broadcasts an ARP query asking for the MAC address of the machine with the IP 192.168.1.1

The router and the attacker devices both receive the broadcast

Before the router responds, the attacker spoofs a reply saying that the MAC for 192.168.1.1 is associated to the MAC address of ba:d1:ba:d1:ba:d1

The victim adds this to the cache and now sends Ethernet frames which are intended for the router to the attacker instead

Why is this possible?

ARP was designed for simplicity rather than strong authentication. A device receiving an ARP message generally has limited ability to determine whether the information is genuinely coming from the legitimate owner of the IP address.

This creates an opportunity for an attacker on the same network to convince devices that “My MAC address belongs to this IP address.”

If the false information is accepted, network traffic can be redirected.

Man-in-the-Middle attacks

One of the most important uses of ARP Poisoning is to facilitate a Man-in-the-Middle attack.

A Man-in-the-Middle attack occurs when an attacker positions themselves between two communicating systems. Rather than simply receiving the data form the victim, the attacker intercepts the data and then forwards it on to the intended device. This means that the 2 parties involved don’t realise the data is being intercepted.

By doing this, the attacker can potentially observe, manipulate, or disrupt traffic passing through their system.

The attacker effectively becomes an intermediary.

ARP Poisoning and traffic interception

If the attacker successfully positions themselves between the victim and gateway, they may be able to observe network traffic. However, potentially exposed information depends heavily on the protocols being used – Unencrypted traffic can be particularly vulnerable, however, encryption such as HTTPS/TLS can significantly limit what the attacker can see.

This is an important distinction – ARP Poisoning does not automatically mean that an attacker can read encrypted communications.

It provides a position from which traffic can potentially be observed or manipulated.

Encryption determines what information can subsequently be understood.

ARP Poisoning and traffic modification

ARP Poisoning can potentially allow an attacker to modify traffic rather than simply observe it.

The attacker may attempt to alter packets before forwarding them on to their destination

This could potentially affect:

• Network communications
• Application traffic
• Downloads
• DNS requests
• HTTP traffic
• Other unencrypted protocols

Again, strong cryptographic protections can prevent many forms of meaningful manipulation.

ARP Poisoning and denial of service

ARP Poisoning does not necessarily have to be used for interception – An attacker can also use false ARP information to disrupt communications.

For example, a victim may be told that the gateway’s IP address corresponds to an incorrect MAC address. Here, traffic intended for the gateway may then be sent to the wrong device.

This can result in:

• Loss of connectivity
• Intermittent network access
• Packet loss
• Network instability
• Service disruption

ARP manipulation can therefore be used as a form of local network denial of service.

ARP Poisoning vs ARP Spoofing

The terms ARP Poisoning and ARP Spoofing are frequently used interchangeably. However, there is a subtle distinction.

• ARP Spoofing generally describes sending false ARP information.
• ARP Poisoning describes the resulting manipulation of another device’s ARP cache.

In practical cybersecurity discussions, however, the two terms are often treated as describing the same attack technique.

What is the ARP Cache?

The ARP cache is a table maintained by a device containing recently learned IP-to-MAC address mappings.

On a Windows device, you can read the entries in the ARP cache by opening a CMD prompt and then type arp -a

The operating system uses this information to determine where Ethernet frames should be sent. ARP Poisoning attempts to manipulate these entries.

The victim may now send traffic intended for the gateway to the attacker.

The attack therefore depends upon the attacker already having access to the relevant local network.

Why ARP Poisoning is called a Layer 2 attack

ARP operates at the boundary between Layer 2 and Layer 3 of the OSI model. It connects IP addressing with Ethernet MAC addressing

This means ARP Poisoning is fundamentally a local network attack. An attacker generally needs to be on the same broadcast domain or otherwise have appropriate Layer 2 access to facilitate an ARP attack.

This makes ARP Poisoning different from attacks that can be conducted remotely across the Internet.

ARP Poisoning and VLANs

Virtual Local Area Networks (VLANs) can help limit the scope of ARP-based attacks.

A VLAN creates a separate Layer 2 broadcast domain. VLANS are typically created on devices called managed switches

For example:

VLAN 10 – Users

VLAN 20 – Servers

VLAN 30 – Management

By creating separate VLANs for different users, devices, services, or protocols, network administrators can limit the amount of traffic flowing through the network

An attacker on VLAN 10 cannot normally perform ordinary Layer 2 ARP manipulation directly against devices on VLAN 20 – The two VLANS are treated as if they are physically separate networks.

Traffic can flow between two VLANS but is achieved by routing IP packets, not Ethernet frames. Routing between VLANs introduces additional security controls and boundaries.

However, VLANs should not be treated as a complete defence.

A compromised device within a VLAN can still potentially attack other devices in that same broadcast domain.

ARP Poisoning and Man-in-the-Middle attacks

ARP Poisoning is particularly useful for creating a local MITM position.

If forwarding is maintained correctly, the victim may continue to access the network without immediately realising that traffic is being intercepted.

ARP Poisoning and HTTPS

A common misconception is that ARP Poisoning automatically allows attackers to steal passwords. This is not necessarily true.

The attacker may be able to observe that communication is occurring, but HTTPS encrypts the application data.

The attacker may not be able to read the contents of the encrypted session.

ARP Poisoning is therefore much more dangerous against poorly protected or unencrypted protocols than strongly encrypted communications.

ARP Poisoning and DNS

ARP Poisoning can also be combined with other attacks. If an attacker successfully manages to position themselves between a victim and the router with ARP poisoning, then they can potentially manipulate other protocols – such as DNS

This can potentially allow an attacker to redirect a victim towards malicious infrastructure.

The combination of multiple techniques can make attacks significantly more effective.

ARP Poisoning and credential theft

ARP Poisoning can potentially contribute to credential theft when users or applications communicate using protocols that do not adequately protect credentials.

Potentially vulnerable information can include:

• Usernames
• Passwords
• Session information
• Authentication tokens
• Application data

However, modern encrypted protocols significantly reduce the effectiveness of simple traffic interception.

Attackers may therefore attempt to combine ARP Poisoning with additional techniques.

Detecting ARP Poisoning

ARP Poisoning can leave several indicators. Security teams should monitor:

• Duplicate IP-to-MAC mappings
• Unexpected changes in ARP tables
• Frequent ARP replies
• Gratuitous ARP activity
• MAC address changes
• Multiple IP addresses associated with one MAC address
• One IP address associated with multiple MAC addresses
• Unexpected gateway MAC changes

One of the strongest indicators should be the MAC address associated with the default gateway suddenly changing to a different MAC address

This should trigger investigation.

ARP Monitoring

Security teams can monitor ARP activity to establish a baseline of normal behaviour. A normal network may have relatively stable relationships between device IP and Device MAC

Unexpected changes can then be identified.

Network Detection

Network security tools can monitor ARP traffic and identify suspicious behaviour.

Potential detection methods include:

• ARP inspection
• Network intrusion detection
• Switch monitoring
• MAC address monitoring
• Packet analysis
• DHCP snooping
• Dynamic ARP Inspection

These technologies can help identify inconsistencies between legitimate network assignments and observed ARP traffic.

Dynamic ARP Inspection

Dynamic ARP Inspection (DAI) is a switch security feature designed to help prevent ARP spoofing. DAI can validate ARP messages against trusted information maintained by the switch.

A common implementation of DAI works alongside a technique known as DHCP Snooping

Here, the switch builds a database containing expected IP-to-MAC relationships based on the data passed across the network during DHCP handshakes

ARP messages can then be checked against that information.

If an ARP message claims IP → MAC, but the switch’s trusted information indicates that the mapping is invalid, the switch can block the traffic.

Port Security

Switch port security can help restrict which MAC addresses are permitted on particular switch ports. For example, an organisation may configure a switch port so that only expected devices can use it.

If an unexpected MAC address appears, the switch can take action according to its security configuration.

Port security does not directly eliminate ARP Poisoning, but it can reduce opportunities for unauthorised devices to gain network access.

ARP Poisoning in a SOC

Security Operations Centre (SOC) analysts may encounter ARP-related alerts during network investigations.

Useful questions a SOC analyst should ask include:

• Which device sent the suspicious ARP messages?
• Which IP address was being claimed?
• Which MAC address was advertised?
• Did the gateway mapping change?
• Which systems received the traffic?
• Did the suspicious device recently join the network?
• Did network connectivity change?
• Did the activity coincide with credential or data theft?
• Were other MITM techniques observed?
• Did the suspicious device communicate with external infrastructure?

The goal is to establish whether the activity represents Normal network behaviour, or Intentional ARP manipulation.

How can organisations prevent ARP Poisoning?

Organisations should consider:

• Dynamic ARP Inspection – Use switch-level ARP validation where supported.
• DHCP Snooping – Maintain trusted IP-to-MAC-to-port relationships.
• VLAN segmentation – Reduce the size of Layer 2 broadcast domains.
• Network Access Control – Prevent unauthorised devices from joining internal networks.
• Port Security – Restrict unexpected devices and MAC addresses.
• Encryption – Use HTTPS, TLS, SSH, VPNs, and other secure protocols.
• Monitor ARP activity – Look for unexpected changes in IP-to-MAC relationships.
• Secure network infrastructure – Ensure switches, routers, wireless infrastructure, and management interfaces are properly secured.
• Endpoint protection – Monitor systems for suspicious network configuration changes and unusual network behaviour.

Conclusion

ARP is a fundamental component of IPv4 networking. It allows devices to translate IP addresses into MAC addresses so that traffic can be delivered across local Ethernet networks. Without APR, devices would be cut off form communicating.

However, the traditional ARP protocol does not provide strong authentication – This creates an opportunity for attackers to send fraudulent ARP information and manipulate the ARP caches of other devices.

ARP Poisoning can allow an attacker to redirect network traffic through their own system, creating a potential Man-in-the-Middle position.

The effectiveness of the attack is significantly reduced when strong encryption is used, but encryption does not prevent the underlying ARP manipulation.

Defending against ARP Poisoning therefore requires multiple layers of protection.

Dynamic ARP Inspection, DHCP Snooping, VLAN segmentation, Network Access Control, port security, network monitoring, and strong encryption can all contribute to reducing the risk.

The key lesson is simple – Never assume that a local network is automatically trustworthy. A device being connected to the same network does not mean that the traffic it generates should automatically be trusted.

Understanding ARP Poisoning is therefore essential for cybersecurity professionals because it demonstrates how attackers can exploit fundamental network protocols to position themselves between legitimate systems.

The attack may begin with a simple false ARP message – but the consequences can extend far beyond the local network.