How does ARP spoofing work, and what are the defenses?
Show the answer
Say this first
ARP has no authentication, and hosts accept ARP replies they never asked for. The attacker sends forged replies, often gratuitous ARPs, telling victims "the gateway's IP is at my MAC" and telling the gateway "the victim's IP is at my MAC". Both caches are poisoned, so traffic flows through the attacker, who can read or change it (man in the middle) or drop it (denial of service). The switch defense is Dynamic ARP Inspection backed by DHCP snooping, which drops ARPs whose IP and MAC pair does not match the binding table. Encryption such as TLS, SSH and IPsec limits what a man in the middle can read.
Go deeper
What it looks like
- On a victim,
arp -ashows the gateway 10.10.10.1 mapped to a workstation's MAC, often the same MAC as another IP in the table. - Users see certificate warnings when the attacker tries to intercept TLS.
- DAI, if enabled, logs
%SW_DAI-4-DHCP_SNOOPING_DENYwith the attacker's MAC and the claimed IP.
Defenses, in order of value
- Dynamic ARP Inspection with DHCP snooping on access VLANs.
- 802.1X so only known devices get a port at all.
- Port isolation or private VLANs where hosts never need to talk to each other.
- Static ARP entries for a few critical devices. Does not scale.
- Encryption everywhere, so interception gains little.
- Detection: tools that alert on IP to MAC changes, and IDS signatures for gratuitous ARP storms.
They will ask next
What is the IPv6 version of this attack?
Forged Neighbor Advertisements and rogue Router Advertisements. The defenses are RA Guard, ND inspection and DHCPv6 Guard, which on Cisco are part of the switch's IPv6 first hop security.
Can ARP spoofing reach across a router?
No. ARP lives inside one layer 2 segment, so the attacker must be in the same VLAN as the victim or the gateway it impersonates.
Traps
- Saying port security stops ARP spoofing. The attacker uses its own real MAC; only the ARP contents lie.