ARP, the Address Resolution Protocol, maps an IP address to a device’s MAC address on a local network. Attackers abuse it for spoofing and poisoning to divert traffic, intercept sessions, or cause outages. Defenders monitor for duplicate mappings, unexpected MAC changes, and static ARP controls on sensitive segments.
ARP as a local resolution protocol
ARP sits at the boundary between IP networking and link-layer delivery. It lets a host learn the MAC address needed to reach a neighbour on the same broadcast domain, which makes it a basic dependency for local traffic forwarding and a frequent target for abuse.
Because ARP is unauthenticated and trust-based, it is efficient but fragile. Any host that can speak on the segment can try to influence mappings, which is why ARP behaviour matters most on flat or lightly segmented networks where local trust assumptions are weakest.
How ARP enables communication on a LAN
When a device needs to send an IP packet to a local peer, it first needs the destination hardware address. ARP provides that mapping so the sender can place the frame on the wire with the correct next-hop MAC address.
This lookup is local to the broadcast domain, so ARP is not a routing protocol. It does not move traffic between networks, it resolves the last-hop delivery information that Ethernet and similar link-layer media need to carry the packet.
That limited scope is also what makes ARP so operationally important: if the mapping is wrong, stale, or manipulated, the packet still leaves the host, but it can reach the wrong device or fail to reach the right one.
Why ARP poisoning is effective
arp spoofing and poisoning work because many systems accept ARP replies without strong validation. An attacker can advertise a false IP-to-MAC association and cause traffic to be redirected, intercepted, or black-holed.
That creates classic man-in-the-middle and denial-of-service outcomes. A forged mapping can silently sit between two endpoints, or it can simply break communication by sending frames to the wrong destination. For defenders, the danger is often not only packet loss, but also the loss of trust in local path integrity.
In practice, the impact depends on where the segment sits in the network. Sensitive user VLANs, server farms, and management networks are all more exposed when ARP is left entirely to dynamic neighbour learning.
How defenders monitor and constrain ARP behaviour
Defence usually starts with baseline visibility. Unexpected MAC changes, duplicate IP-to-MAC mappings, and sudden shifts in neighbour tables are common indicators that ARP is being manipulated or that a device has moved unexpectedly.
Where the risk is material, static ARP entries, switch port protections, and segmentation on sensitive networks can reduce exposure. The goal is not to eliminate ARP, but to make poisoning harder and more detectable on the segments that matter most.
ARP also benefits from being treated as part of broader layer-2 hygiene. If the network design makes every host able to see and influence every other host, ARP becomes an easier abuse path than it should be.
Risk and Threat Considerations
ARP is especially risky because it is both foundational and weakly protected: a poisoned mapping can redirect traffic without touching the application layer, which makes the abuse hard to notice until sessions fail or data is exposed.
Failure mechanism: An attacker on the same local segment forges or races ARP replies, causing hosts to cache a false MAC address for a target IP.
Impact: The attacker can intercept traffic, degrade availability, or insert themselves into trusted local communications, especially where monitoring does not validate ARP table changes against expected network behaviour.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | ARP poisoning changes local traffic flow and trust boundaries. |
| CM-7 — Least Functionality | Restricting unnecessary layer-2 reachability reduces ARP abuse opportunities. | |
| SI-4 — System Monitoring | ARP anomalies are detected through monitoring for duplicate or changing mappings. | |
| Recommendation — Enforce traffic flow rules that limit which hosts can influence sensitive local segments. Remove unnecessary hosts and services from sensitive network segments. Monitor neighbour and MAC mapping changes for signs of spoofing or poisoning. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Network device and segment controls directly govern ARP exposure and enforcement. |
| CIS-13 — Network Monitoring and Defense | ARP poisoning is a network abuse pattern that requires detection at the traffic layer. | |
| Recommendation — Harden switching and segmentation controls to reduce local spoofing opportunities. Alert on duplicate mappings and abnormal MAC movement across the network. | ||