Address Resolution Protocol spoofing is a local network attack where a device sends forged ARP messages to map its MAC address to another device’s IP address. It works on IPv4 LANs that use ARP for address-to-MAC resolution, letting the attacker intercept, redirect or disrupt traffic between hosts on the same broadcast domain.
How ARP Spoofing Works
ARP spoofing abuses the fact that ARP is a trust-based IPv4 local-resolution protocol. By sending forged ARP replies, an attacker can convince nearby hosts that a chosen IP address maps to the attacker’s MAC address, or poison a gateway’s view of a victim host.
The practical effect is that traffic on the same broadcast domain can be redirected through the attacker, dropped, or observed in transit. Because ARP is local to the LAN, the attack is most effective where hosts rely on unauthenticated address resolution and do not validate the mapping they receive.
Why It Is Dangerous on Local Networks
ARP spoofing is dangerous because it turns ordinary Layer 2 trust into a traffic interception and disruption opportunity. Once a mapping is poisoned, the attacker may sit between peers in a man-in-the-middle position, break connectivity outright, or selectively tamper with session traffic.
This matters most on flat networks and shared broadcast domains where one compromised endpoint can influence many neighbors. It also becomes more damaging when sensitive admin sessions, legacy cleartext protocols, or internal service traffic traverse the same segment.
How Organisations Check Exposure
Exposure assessment starts with knowing where IPv4 LANs still depend on ARP, which segments are shared, and which devices can directly reach one another at Layer 2. The key question is not just whether ARP exists, but whether the network design allows untrusted or less-trusted hosts to poison mappings that matter.
Teams should review switch configuration, host placement, and segmentation boundaries, then compare them with vendor guidance for anti-spoofing and source-address validation. A useful reference point is the Source Address Validation and Anti-Spoofing Guide, which covers BCP 38, BCP 84, uRPF, bogon filtering, and rollout considerations.
Detection, Prevention, and Recovery
Prevention is strongest when Layer 2 trust is narrowed with segmentation, dynamic ARP inspection, static bindings where appropriate, and source-address validation at the network edge. If those controls are not available everywhere, organisations should at least reduce the blast radius of any one poisoned segment.
Detection usually comes from inconsistencies: one IP suddenly appearing with multiple MAC addresses, gateway traffic flowing through an unexpected host, or ARP changes that do not match approved inventory. After suspected exploitation, verify whether traffic capture, credential interception, or session hijacking occurred, then reset affected sessions and review adjacent systems for lateral movement.
Risk and Threat Considerations
ARP spoofing is not just a nuisance, it is a traffic-path compromise that can expose credentials, redirect internal services, and undermine trust in local communications. The risk grows when the segment carries privileged access, unsupported protocols, or systems that assume the LAN is inherently trustworthy.
Failure mechanism: The attacker poisons ARP state so hosts send traffic to the wrong MAC address, enabling interception, tampering, or denial of service on the local broadcast domain.
Impact: Sessions may be hijacked, internal data may be exposed, and downstream compromise can spread if the attacker uses the position to capture credentials or pivot to other hosts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | ARP spoofing exploits weak local trust boundaries and lateral traffic paths. |
| AC-4 — Information Flow Enforcement | Traffic redirection from ARP poisoning is a flow-control failure on internal networks. | |
| SI-4 — System Monitoring | Detection depends on spotting abnormal address-to-MAC changes and redirected traffic patterns. | |
| Recommendation — Enforce boundary controls to limit spoofable local traffic paths and segment hosts that should not interact directly. Apply information flow enforcement to restrict which systems can exchange local traffic across trust boundaries. Monitor for inconsistent ARP mappings and unexpected local traffic redirection. | ||
| NIST CSF 2.0 | PR.AA-05 — Least Privilege | Limiting reachability and trust on the LAN reduces what a spoofed host can affect. |
| Recommendation — Restrict host and network reachability to the minimum required for each segment. | ||
Practitioner Guidance
What to watch for: Treat ARP spoofing as a segmentation and trust-boundary problem, not only a packet anomaly. Flat networks, unmanaged endpoints, and shared VLANs create the easiest path for poisoning to succeed.
Governance implication: Ownership should sit with network and security teams together, because the right answer depends on both routing policy and Layer 2 control enforcement. Practitioners should validate whether anti-spoofing controls are actually enforced where the network matters most, rather than assuming the design is safe because it is documented.