OSI LAYER 2 // Data Link Layer

ARP Spoofing / ARP Poisoning

ARP spoofing sends misleading IP-to-MAC mappings on a local network so traffic can be redirected or intercepted.

01 // HOW IT WORKS

Mechanism

Hosts update their ARP cache from local network messages. An attacker can abuse that trust if the network lacks validation or segmentation.

02 // DETECTION

Indicators to watch

Frequent ARP changes, duplicate IP/MAC mappings, gateway MAC changes, and unexpected ARP replies.

03 // ATTACK FLOW

Concept diagram

01Local hosts↓

02Forged ARP mapping↓

03ARP cache changes↓

04Traffic redirected↓

05DAI + DHCP snooping

04 // PREVENTION

Defensive controls

Use DHCP snooping, Dynamic ARP Inspection, static bindings where practical, segmentation, secure management, and endpoint monitoring.

05 // SECURITY TOOL

Recommended security control

Switch DAI / arpwatch

Use a private virtual LAN or emulator for demonstrations.

06 // DEFENCE PRACTICE LAB

Defence practice lab

The administrator has not attached a tool link yet. This slot will show “Build Soon” until an external link is configured.

Build Soon

◈

DEFENCE PRACTICE LAB // BUILD SOONThe administrator can add or edit an external defence practice lab link from the private admin portal.

07 // DEFENCE TECHNIQUES

Defence techniques

Defence techniques for this attack will be added by the administrator.

AUTHORIZED LEARNING

All attack descriptions are for defensive education. Test scanning, traffic generation, interception, wireless testing, and vulnerable applications only on systems and networks you own or are explicitly authorized to assess.