thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

ARP Poisoning

Sending forged ARP replies to associate the attacker's MAC address with another host's IP, redirecting LAN traffic.

Definition

Because ARP has no authentication, hosts accept unsolicited replies and update their caches. Attackers typically poison the default gateway entry to intercept all traffic from victims, enabling on-path attacks. Dynamic ARP Inspection with DHCP snooping on switches prevents it.

Example

Using arpspoof to tell a victim that the gateway 192.168.1.1 is at the attacker's MAC.

Exam tip

Dynamic ARP Inspection (DAI) is the switch feature that stops ARP poisoning.

Related terms