ARP spoofing in Computer Networks - Step-by-Step Execution

Concept Flow - ARP spoofing

Attacker sends fake ARP reply

↓

Victim updates ARP cache with wrong MAC

↓

Victim sends data to attacker instead of real device

↓

Attacker can intercept or modify data

↓

Attacker may forward data to real device to avoid detection

The attacker sends false ARP messages to a victim, causing the victim to associate the attacker's MAC address with a legitimate IP address, redirecting traffic through the attacker.

Execution Sample

Computer Networks

Attacker sends ARP reply: IP 192.168.1.1 is at MAC AA:BB:CC:DD:EE:FF
Victim updates ARP cache: 192.168.1.1 -> AA:BB:CC:DD:EE:FF
Victim sends data to MAC AA:BB:CC:DD:EE:FF (attacker)
Attacker intercepts and forwards data to real 192.168.1.1

This sequence shows how an attacker tricks a victim into sending data to the attacker by faking ARP replies.

Analysis Table

Step	Action	Victim ARP Cache	Victim Data Destination	Attacker Action
1	Attacker sends fake ARP reply	Empty or correct	Normal (to real MAC)	Sends ARP reply claiming IP 192.168.1.1 is at attacker's MAC
2	Victim updates ARP cache	192.168.1.1 -> Attacker MAC	Now points to attacker MAC	Waits to intercept data
3	Victim sends data	192.168.1.1 -> Attacker MAC	Sends data to attacker MAC	Intercepts data
4	Attacker forwards data	192.168.1.1 -> Attacker MAC	Victim unaware	Forwards data to real 192.168.1.1 to avoid detection
5	Attack continues	192.168.1.1 -> Attacker MAC	Victim sends data to attacker	Intercepts or modifies data
6	Attack ends or detected	ARP cache cleared or corrected	Data sent to correct MAC	Attack stops
Exit	Victim ARP cache corrected	192.168.1.1 -> Real MAC	Data sent to real device	No interception

💡 Victim updates ARP cache with correct MAC, stopping the spoofing attack.

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Victim ARP Cache for 192.168.1.1	Real MAC	Real MAC	Attacker MAC	Attacker MAC	Attacker MAC	Real MAC
Victim Data Destination MAC	Real MAC	Real MAC	Attacker MAC	Attacker MAC	Attacker MAC	Real MAC
Attacker State	Idle	Sent fake ARP	Waiting	Intercepting	Forwarding	Idle

Key Insights - 3 Insights

Why does the victim update its ARP cache with the attacker's MAC?

Because the attacker sends a fake ARP reply claiming to be the IP owner, and the victim trusts this reply, updating its cache as shown in execution_table row 2.

Does the victim know its data is going to the attacker?

No, the victim believes it is sending data to the real device because the ARP cache points to the attacker's MAC, as seen in execution_table row 3.

How can the attacker avoid detection after intercepting data?

By forwarding the intercepted data to the real device, the attacker keeps the communication normal from the victim's view, as shown in execution_table row 4.

Visual Quiz - 3 Questions

Look at the execution_table at step 2. What does the victim's ARP cache map 192.168.1.1 to?

A Empty

B Real MAC

C Attacker MAC

D Broadcast MAC

💡 Hint

Check the 'Victim ARP Cache' column at step 2 in the execution_table.

At which step does the victim start sending data to the attacker instead of the real device?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look at the 'Victim Data Destination' column to see when it changes to attacker MAC.

If the victim never updated its ARP cache, what would happen to the data destination?

A Data would go to attacker MAC

B Data would go to real MAC

C Data would be lost

D Data would broadcast to all

💡 Hint

Refer to the 'Victim ARP Cache' and 'Victim Data Destination' columns at start and step 1.

Concept Snapshot

ARP spoofing is when an attacker sends fake ARP replies to a victim.
This tricks the victim into associating the attacker's MAC with a trusted IP.
Victim sends data to attacker unknowingly.
Attacker can intercept, modify, or forward data.
Attack stops when ARP cache is corrected.

Full Transcript

ARP spoofing happens when an attacker sends false ARP messages to a victim device. The victim updates its ARP cache to link an IP address to the attacker's MAC address instead of the real device. This causes the victim to send data to the attacker. The attacker can then intercept or change the data before forwarding it to the real device to avoid detection. The attack ends when the victim corrects its ARP cache to the real MAC address.

Practice

1. What is the main purpose of ARP spoofing in a computer network?

easy

A. To speed up data transmission between devices

B. To trick devices by sending fake address information

C. To encrypt data for secure communication

D. To block all incoming network traffic

Solution

1. Step 1: Understand ARP function

   ARP (Address Resolution Protocol) maps IP addresses to physical MAC addresses on a local network.

2. Step 2: Identify ARP spoofing action

   ARP spoofing sends fake ARP messages to associate an attacker's MAC address with another device's IP address.

3. Final Answer:

   To trick devices by sending fake address information -> Option B

4. Quick Check:

   ARP spoofing = sending fake address info [OK]

Hint: ARP spoofing means sending fake address info to devices [OK]

Common Mistakes:

• Confusing ARP spoofing with encryption
• Thinking ARP spoofing speeds up networks
• Believing ARP spoofing blocks traffic

2. Which of the following is a correct description of an ARP spoofing attack?

easy

A. An attacker sends fake ARP replies to associate their MAC with another IP

B. An attacker blocks ARP requests to stop communication

C. An attacker encrypts ARP packets to hide data

D. An attacker floods the network with DNS requests

Solution

1. Step 1: Review ARP spoofing mechanism

   Attackers send fake ARP replies to link their MAC address to a victim's IP address.

2. Step 2: Eliminate incorrect options

   Blocking ARP requests, encrypting ARP packets, or flooding DNS requests are unrelated to ARP spoofing.

3. Final Answer:

   An attacker sends fake ARP replies to associate their MAC with another IP -> Option A

4. Quick Check:

   Fake ARP replies = ARP spoofing [OK]

Hint: ARP spoofing = fake ARP replies linking MAC to IP [OK]

Common Mistakes:

• Confusing ARP spoofing with DNS attacks
• Thinking ARP spoofing encrypts data
• Believing ARP spoofing blocks ARP requests

3. Consider this Python-like pseudocode simulating ARP spoofing detection:

arp_table = {"192.168.1.2": "00:11:22:33:44:55"}
new_arp_reply = ("192.168.1.2", "66:77:88:99:AA:BB")
if arp_table[new_arp_reply[0]] != new_arp_reply[1]:
    alert = "Possible ARP spoofing detected"
else:
    alert = "No spoofing"
print(alert)

What will be printed?

medium

A. SyntaxError

B. No spoofing

C. KeyError

D. Possible ARP spoofing detected

Solution

1. Step 1: Check ARP table entry

   IP "192.168.1.2" maps to MAC "00:11:22:33:44:55" in arp_table.

2. Step 2: Compare new ARP reply MAC

   New MAC "66:77:88:99:AA:BB" differs from stored MAC, triggering alert.

3. Final Answer:

   Possible ARP spoofing detected -> Option D

4. Quick Check:

   MAC mismatch triggers spoofing alert [OK]

Hint: If new MAC differs from stored MAC, alert spoofing [OK]

Common Mistakes:

• Assuming no spoofing if IP exists
• Expecting syntax or key errors
• Ignoring MAC address comparison

4. A network administrator wrote this code snippet to detect ARP spoofing but it always prints "No spoofing" even when attacks happen:

arp_table = {"192.168.1.5": "AA:BB:CC:DD:EE:FF"}
new_arp_reply = ("192.168.1.5", "11:22:33:44:55:66")
if arp_table.get(new_arp_reply[0]) == new_arp_reply[1]:
    print("No spoofing")
else:
    print("No spoofing")

What is the error?

medium

A. Both if and else print the same message

B. The arp_table dictionary is empty

C. The new_arp_reply tuple is malformed

D. The get method is used incorrectly

Solution

1. Step 1: Analyze if-else print statements

   Both the if and else blocks print "No spoofing", so no alert is possible.

2. Step 2: Identify logical error

   Because both branches print the same message, spoofing detection never shows an alert.

3. Final Answer:

   Both if and else print the same message -> Option A

4. Quick Check:

   Same print in if/else hides spoofing [OK]

Hint: Check if if/else print different messages [OK]

Common Mistakes:

• Thinking dictionary is empty
• Assuming tuple is malformed
• Believing get method is wrong

5. In a local network, an attacker uses ARP spoofing to intercept data between two devices. Which of the following is the best way to protect the network against this attack?

hard

A. Use a stronger Wi-Fi password

B. Disable all ARP requests on the network

C. Use static ARP entries on critical devices

D. Increase the DHCP lease time

Solution

1. Step 1: Understand ARP spoofing defense

   Static ARP entries prevent devices from accepting fake ARP replies by fixing IP-to-MAC mappings.

2. Step 2: Evaluate other options

   Disabling ARP requests breaks network communication; DHCP lease time and Wi-Fi password do not stop ARP spoofing.

3. Final Answer:

   Use static ARP entries on critical devices -> Option C

4. Quick Check:

   Static ARP entries block spoofing [OK]

Hint: Static ARP entries stop fake address changes [OK]

Common Mistakes:

• Thinking DHCP lease time affects ARP spoofing
• Believing Wi-Fi password stops ARP spoofing
• Trying to disable ARP requests entirely