ARP spoofing in Computer Networks - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the sentence to define ARP spoofing.

Computer Networks

ARP spoofing is a type of attack where an attacker sends fake [1] messages on a local network.

Drag options to blanks, or click blank then click option'

AIP

BARP

CDNS

DHTTP

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing ARP with IP or DNS protocols.

Thinking ARP spoofing involves HTTP messages.

ARP spoofing involves sending fake ARP (Address Resolution Protocol) messages to associate the attacker's MAC address with the IP address of another device.

2fill in blank

medium

Complete the sentence to explain the goal of ARP spoofing.

Computer Networks

The main goal of ARP spoofing is to intercept or [1] network traffic between devices.

Drag options to blanks, or click blank then click option'

Aredirect

Bblock

Cencrypt

Dignore

Attempts:

3 left

💡 Hint

Common Mistakes

Thinking the attacker blocks traffic instead of redirecting it.

Confusing encryption with interception.

ARP spoofing aims to redirect network traffic through the attacker’s device to intercept or manipulate data.

3fill in blank

hard

Fix the error in the description of ARP spoofing.

Computer Networks

In ARP spoofing, the attacker sends fake ARP replies to associate their [1] address with the IP address of another device.

Drag options to blanks, or click blank then click option'

AHTTP

BDNS

CIP

DMAC

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing IP address with MAC address in the attack.

Thinking DNS or HTTP addresses are involved.

The attacker sends fake ARP replies to link their MAC address with another device’s IP address, tricking devices on the network.

4fill in blank

hard

Fill both blanks to describe how ARP spoofing affects network devices.

Computer Networks

When a device receives a fake ARP reply, it updates its [1] table to map an IP address to the attacker's [2] address.

Drag options to blanks, or click blank then click option'

AARP

BIP

CMAC

DDNS

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up IP and MAC addresses in the table.

Confusing ARP table with DNS or IP tables.

The ARP table stores IP-to-MAC address mappings. ARP spoofing tricks devices to update this table with the attacker’s MAC address.

5fill in blank

hard

Fill both blanks to complete the dictionary comprehension that filters devices with IP addresses starting with '192.' and maps them to their MAC addresses.

Computer Networks

devices = {ip: mac for ip, mac in network.items() if ip{BLANK_2}} '192.' and mac != {{BLANK_2}}

Drag options to blanks, or click blank then click option'

A:

B.startswith(

C''

D==

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' instead of ': ' for key-value mapping.

Using '==' instead of .startswith() for string check.

Using wrong quotes or empty string syntax.

The dictionary comprehension creates a new dictionary mapping IPs to MACs where IP starts with '192.' and MAC is not empty.

Practice

1. What is the main purpose of ARP spoofing in a computer network?

easy

A. To speed up data transmission between devices

B. To trick devices by sending fake address information

C. To encrypt data for secure communication

D. To block all incoming network traffic

Solution

1. Step 1: Understand ARP function

   ARP (Address Resolution Protocol) maps IP addresses to physical MAC addresses on a local network.

2. Step 2: Identify ARP spoofing action

   ARP spoofing sends fake ARP messages to associate an attacker's MAC address with another device's IP address.

3. Final Answer:

   To trick devices by sending fake address information -> Option B

4. Quick Check:

   ARP spoofing = sending fake address info [OK]

Hint: ARP spoofing means sending fake address info to devices [OK]

Common Mistakes:

• Confusing ARP spoofing with encryption
• Thinking ARP spoofing speeds up networks
• Believing ARP spoofing blocks traffic

2. Which of the following is a correct description of an ARP spoofing attack?

easy

A. An attacker sends fake ARP replies to associate their MAC with another IP

B. An attacker blocks ARP requests to stop communication

C. An attacker encrypts ARP packets to hide data

D. An attacker floods the network with DNS requests

Solution

1. Step 1: Review ARP spoofing mechanism

   Attackers send fake ARP replies to link their MAC address to a victim's IP address.

2. Step 2: Eliminate incorrect options

   Blocking ARP requests, encrypting ARP packets, or flooding DNS requests are unrelated to ARP spoofing.

3. Final Answer:

   An attacker sends fake ARP replies to associate their MAC with another IP -> Option A

4. Quick Check:

   Fake ARP replies = ARP spoofing [OK]

Hint: ARP spoofing = fake ARP replies linking MAC to IP [OK]

Common Mistakes:

• Confusing ARP spoofing with DNS attacks
• Thinking ARP spoofing encrypts data
• Believing ARP spoofing blocks ARP requests

3. Consider this Python-like pseudocode simulating ARP spoofing detection:

arp_table = {"192.168.1.2": "00:11:22:33:44:55"}
new_arp_reply = ("192.168.1.2", "66:77:88:99:AA:BB")
if arp_table[new_arp_reply[0]] != new_arp_reply[1]:
    alert = "Possible ARP spoofing detected"
else:
    alert = "No spoofing"
print(alert)

What will be printed?

medium

A. SyntaxError

B. No spoofing

C. KeyError

D. Possible ARP spoofing detected

Solution

1. Step 1: Check ARP table entry

   IP "192.168.1.2" maps to MAC "00:11:22:33:44:55" in arp_table.

2. Step 2: Compare new ARP reply MAC

   New MAC "66:77:88:99:AA:BB" differs from stored MAC, triggering alert.

3. Final Answer:

   Possible ARP spoofing detected -> Option D

4. Quick Check:

   MAC mismatch triggers spoofing alert [OK]

Hint: If new MAC differs from stored MAC, alert spoofing [OK]

Common Mistakes:

• Assuming no spoofing if IP exists
• Expecting syntax or key errors
• Ignoring MAC address comparison

4. A network administrator wrote this code snippet to detect ARP spoofing but it always prints "No spoofing" even when attacks happen:

arp_table = {"192.168.1.5": "AA:BB:CC:DD:EE:FF"}
new_arp_reply = ("192.168.1.5", "11:22:33:44:55:66")
if arp_table.get(new_arp_reply[0]) == new_arp_reply[1]:
    print("No spoofing")
else:
    print("No spoofing")

What is the error?

medium

A. Both if and else print the same message

B. The arp_table dictionary is empty

C. The new_arp_reply tuple is malformed

D. The get method is used incorrectly

Solution

1. Step 1: Analyze if-else print statements

   Both the if and else blocks print "No spoofing", so no alert is possible.

2. Step 2: Identify logical error

   Because both branches print the same message, spoofing detection never shows an alert.

3. Final Answer:

   Both if and else print the same message -> Option A

4. Quick Check:

   Same print in if/else hides spoofing [OK]

Hint: Check if if/else print different messages [OK]

Common Mistakes:

• Thinking dictionary is empty
• Assuming tuple is malformed
• Believing get method is wrong

5. In a local network, an attacker uses ARP spoofing to intercept data between two devices. Which of the following is the best way to protect the network against this attack?

hard

A. Use a stronger Wi-Fi password

B. Disable all ARP requests on the network

C. Use static ARP entries on critical devices

D. Increase the DHCP lease time

Solution

1. Step 1: Understand ARP spoofing defense

   Static ARP entries prevent devices from accepting fake ARP replies by fixing IP-to-MAC mappings.

2. Step 2: Evaluate other options

   Disabling ARP requests breaks network communication; DHCP lease time and Wi-Fi password do not stop ARP spoofing.

3. Final Answer:

   Use static ARP entries on critical devices -> Option C

4. Quick Check:

   Static ARP entries block spoofing [OK]

Hint: Static ARP entries stop fake address changes [OK]

Common Mistakes:

• Thinking DHCP lease time affects ARP spoofing
• Believing Wi-Fi password stops ARP spoofing
• Trying to disable ARP requests entirely