ARP spoofing in Computer Networks - Step-by-Step Execution

Concept Flow - ARP spoofing

Attacker sends fake ARP reply

↓

Victim updates ARP cache with wrong MAC

↓

Victim sends data to attacker instead of real device

↓

Attacker can intercept or modify data

↓

Attacker may forward data to real device to avoid detection

The attacker sends false ARP messages to a victim, causing the victim to associate the attacker's MAC address with a legitimate IP address, redirecting traffic through the attacker.

Execution Sample

Computer Networks

Attacker sends ARP reply: IP 192.168.1.1 is at MAC AA:BB:CC:DD:EE:FF
Victim updates ARP cache: 192.168.1.1 -> AA:BB:CC:DD:EE:FF
Victim sends data to MAC AA:BB:CC:DD:EE:FF (attacker)
Attacker intercepts and forwards data to real 192.168.1.1

This sequence shows how an attacker tricks a victim into sending data to the attacker by faking ARP replies.

Analysis Table

Step	Action	Victim ARP Cache	Victim Data Destination	Attacker Action
1	Attacker sends fake ARP reply	Empty or correct	Normal (to real MAC)	Sends ARP reply claiming IP 192.168.1.1 is at attacker's MAC
2	Victim updates ARP cache	192.168.1.1 -> Attacker MAC	Now points to attacker MAC	Waits to intercept data
3	Victim sends data	192.168.1.1 -> Attacker MAC	Sends data to attacker MAC	Intercepts data
4	Attacker forwards data	192.168.1.1 -> Attacker MAC	Victim unaware	Forwards data to real 192.168.1.1 to avoid detection
5	Attack continues	192.168.1.1 -> Attacker MAC	Victim sends data to attacker	Intercepts or modifies data
6	Attack ends or detected	ARP cache cleared or corrected	Data sent to correct MAC	Attack stops
Exit	Victim ARP cache corrected	192.168.1.1 -> Real MAC	Data sent to real device	No interception

💡 Victim updates ARP cache with correct MAC, stopping the spoofing attack.

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Victim ARP Cache for 192.168.1.1	Real MAC	Real MAC	Attacker MAC	Attacker MAC	Attacker MAC	Real MAC
Victim Data Destination MAC	Real MAC	Real MAC	Attacker MAC	Attacker MAC	Attacker MAC	Real MAC
Attacker State	Idle	Sent fake ARP	Waiting	Intercepting	Forwarding	Idle

Key Insights - 3 Insights

Why does the victim update its ARP cache with the attacker's MAC?

Because the attacker sends a fake ARP reply claiming to be the IP owner, and the victim trusts this reply, updating its cache as shown in execution_table row 2.

Does the victim know its data is going to the attacker?

No, the victim believes it is sending data to the real device because the ARP cache points to the attacker's MAC, as seen in execution_table row 3.

How can the attacker avoid detection after intercepting data?

By forwarding the intercepted data to the real device, the attacker keeps the communication normal from the victim's view, as shown in execution_table row 4.

Visual Quiz - 3 Questions

Look at the execution_table at step 2. What does the victim's ARP cache map 192.168.1.1 to?

A Empty

B Real MAC

C Attacker MAC

D Broadcast MAC

💡 Hint

Check the 'Victim ARP Cache' column at step 2 in the execution_table.

At which step does the victim start sending data to the attacker instead of the real device?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look at the 'Victim Data Destination' column to see when it changes to attacker MAC.

If the victim never updated its ARP cache, what would happen to the data destination?

A Data would go to attacker MAC

B Data would go to real MAC

C Data would be lost

D Data would broadcast to all

💡 Hint

Refer to the 'Victim ARP Cache' and 'Victim Data Destination' columns at start and step 1.

Concept Snapshot

ARP spoofing is when an attacker sends fake ARP replies to a victim.
This tricks the victim into associating the attacker's MAC with a trusted IP.
Victim sends data to attacker unknowingly.
Attacker can intercept, modify, or forward data.
Attack stops when ARP cache is corrected.

Full Transcript

ARP spoofing happens when an attacker sends false ARP messages to a victim device. The victim updates its ARP cache to link an IP address to the attacker's MAC address instead of the real device. This causes the victim to send data to the attacker. The attacker can then intercept or change the data before forwarding it to the real device to avoid detection. The attack ends when the victim corrects its ARP cache to the real MAC address.