arp spoofing, become the gateway and the victim

hook

your laptop trusts literally anyone on the network who says "hey, i'm the router." that's the entire vulnerability. arp spoofing isn't some exotic zero day, it's a 30 year old protocol that never had authentication built in, and it's still sitting on every local network you've ever joined. this post walks through how the attack works conceptually and, more importantly, how you lock it down so it doesn't work on your network.

what arp actually is

address resolution protocol is how devices on the same local network map an ip address to a mac address. your computer wants to talk to 192.168.1.1 (your gateway), so it broadcasts "who has this ip" and whoever answers "that's me, here's my mac" gets trusted. no signature, no verification, no proof of identity. it's basically a room full of people yelling their name and everyone just believing the loudest one.

how the spoof works

an attacker on the same network sends two sets of fake arp replies. to your machine, they say "i'm the gateway, send your traffic to me." to the actual gateway, they say "i'm the victim, send that traffic to me." both sides update their arp tables with the attacker's mac address, and now every packet you send has to pass through the attacker first before it continues on. they flip on ip forwarding so the traffic keeps flowing (so you don't notice anything broke), and now they're sitting in the middle of your connection reading everything that isn't encrypted. this is the classic man in the middle setup, and it's why arp spoofing shows up in basically every intro pentesting course. we're not walking through the tool commands here because the point of this blog is defense, but understanding the mechanism is exactly what lets you spot it and shut it down.

what this looks like from the defender's side

the giveaway is duplicate or changing mac addresses tied to your gateway's ip. under normal conditions your gateway's mac address in your arp table should never change. if you check it and it's flipping between two different mac addresses, or if two devices are claiming the same ip, someone is spoofing arp on your segment. you can check your own table quickly:

arp -a

look at the mac address listed for your gateway ip. write it down. check it again in ten minutes. if it changed and you didn't touch your network hardware, that's your red flag.

the real fix: dynamic arp inspection

dynamic arp inspection, or dai, is a switch level feature that stops this cold. the switch keeps a trusted binding table of which ip address belongs to which mac address on which port, usually built from dhcp snooping records. when an arp packet comes in, the switch checks it against that table. if the ip to mac mapping doesn't match what the switch already knows to be true, the packet gets dropped before it ever reaches another device. the attacker can yell all the fake arp replies they want, the switch just isn't listening.

on a cisco switch this generally looks like enabling dhcp snooping first (since dai leans on it for the trust table), then turning on arp inspection per vlan:

ip dhcp snooping
ip dhcp snooping vlan 10
ip arp inspection vlan 10

the exact syntax varies by vendor, but the concept is universal: don't trust layer 2 traffic just because it showed up. verify it against something you already know to be true.

other layers of defense worth stacking

dai is the strongest fix but it requires managed switches, which not everyone has at home. a few backup options:

static arp entries for critical devices like your gateway, so the entry can't be overwritten by a spoofed reply. tedious to maintain at scale, fine for a small home network.

arp monitoring tools like arpwatch, which log every ip to mac pairing change and alert you when something shifts unexpectedly.

port security on managed switches, limiting how many mac addresses can show up on a single port, which makes it harder for a rogue device to blend in.

encryption everywhere, tls, vpns, ssh. arp spoofing gets you in the middle of the traffic, but if everything is encrypted end to end, being in the middle just means the attacker collects a pile of garbage they can't read.

the takeaway

arp was built for a trusted, small network in the 1980s and it still runs that way today on almost everything. the fix isn't complicated, it's just often skipped. enable dhcp snooping and dynamic arp inspection on any switch that supports it, watch your arp table on networks that don't, and never assume layer 2 traffic is telling you the truth. trust nothing on layer 2, verify everything.