ARP Cache Poisoning

Last reviewed: August 29, 2026

ARP Cache Poisoning

Overview

Address Resolution Protocol (ARP) Cache Poisoning is a network attack technique that involves sending falsified ARP messages over a local area network (LAN). This attack aims to associate the attacker's Media Access Control (MAC) address with the IP address of a legitimate host, such as a gateway or another device. As a result, traffic intended for the legitimate host is redirected to the attacker. This technique can lead to various malicious activities, including data interception, session hijacking, and denial of service. As of October 2023, ARP cache poisoning remains a prevalent threat in network security, particularly in environments lacking robust security measures.

How it works

ARP is a protocol used to map IP addresses to MAC addresses, which are necessary for data link layer communications within a network. ARP cache poisoning exploits the lack of authentication in ARP messages. Attackers send unsolicited ARP replies, known as "gratuitous ARP," to a target device, associating the attacker's MAC address with the IP address of another device on the network. This process involves the following steps:

Discovery: The attacker identifies the IP addresses of devices within the network, particularly focusing on high-value targets like gateways or servers.

Spoofing: The attacker sends falsified ARP messages to the target device. These messages claim that the attacker's MAC address should be associated with the IP address of the legitimate device.

Redirection: Once the target device updates its ARP cache with the false information, traffic intended for the legitimate device is redirected to the attacker.

Exploitation: The attacker can now intercept, modify, or block the traffic. This can lead to data theft, session hijacking, or network disruption.

Observed use

ARP cache poisoning has been observed in various cyberattacks, often as a precursor to more complex attacks. It is commonly used in man-in-the-middle (MITM) attacks, where the attacker intercepts communications between two parties without their knowledge. This technique has been employed in both targeted attacks against specific organizations and opportunistic attacks on public networks, such as those found in cafes or airports.

In some cases, ARP cache poisoning has been used to facilitate denial of service (DoS) attacks by disrupting network communications. By poisoning the ARP cache of critical network devices, attackers can cause significant network outages.

Detection

Detecting ARP cache poisoning can be challenging due to its stealthy nature. However, network administrators can employ several techniques to identify potential attacks:

Monitoring ARP Traffic: Analyzing ARP traffic for unusual patterns, such as a high volume of ARP replies or multiple devices claiming the same IP address, can indicate an attack.

ARP Table Consistency Checks: Regularly comparing ARP tables across devices can help identify discrepancies caused by poisoning.

Intrusion Detection Systems (IDS): Deploying IDS with ARP spoofing detection capabilities can alert administrators to potential attacks.

Mitigation

Preventing ARP cache poisoning requires a combination of network security measures:

Static ARP Entries: Configuring static ARP entries for critical devices can prevent unauthorized changes to the ARP cache.

Port Security: Implementing port security features on network switches can limit the number of MAC addresses allowed per port, reducing the risk of spoofing.

Dynamic ARP Inspection (DAI): Enabling DAI on network switches can validate ARP packets against a trusted database, blocking malicious ARP messages.

Encryption: Using secure protocols, such as HTTPS or VPNs, can protect data from interception, even if ARP cache poisoning occurs.

See also

None

Sources