ARP Cache Poisoning

How ARP Cache Poisoning Works

ARP cache poisoning abuses the gap between an IP address and the Layer 2 MAC address a host believes it should use. By sending forged ARP replies, the attacker can make nearby devices update their ARP tables with a false mapping, so traffic is redirected to the attacker instead of the intended host. This is why the attack is limited to the same broadcast domain, where ARP operates without built-in authentication.

The technique is often called ARP spoofing, and in practice it is a form of local man-in-the-middle abuse. The attacker does not need to “break” encryption to cause harm, because the value of the attack is in controlling the path that packets take before they ever reach higher-layer protections. For a broader view of how this fits into interception attacks, see the Man-in-the-Middle Attacks Guide.

Why It Is Dangerous on Local Networks

The main danger is that hosts trust ARP as a fast, lightweight resolution mechanism, so a poisoned cache can silently reroute traffic without changing the victim’s IP configuration. That can enable credential capture, session interception, traffic manipulation, or a denial of service if the attacker blackholes packets rather than forwarding them.

ARP poisoning is especially effective where east-west traffic is flat, switch protections are weak, or devices share a broad Layer 2 segment. It also becomes a stepping stone for abuse of adjacent name-resolution and relay techniques, which is why it is commonly grouped with other adversary-in-the-middle methods in detection and hardening guidance.

On mixed or unmanaged networks, the impact can extend beyond a single host pair because the attacker can target many devices on the segment, not just one conversation. That makes it a network integrity problem as much as an interception problem, since the attacker can influence who talks to whom at the packet-delivery layer.

How Organisations Check Exposure and Reduce Attack Surface

Exposure starts with knowing which network segments still rely on ARP for untrusted or loosely controlled device populations. Teams should verify where switches, wireless bridges, guest VLANs, lab environments, and unmanaged endpoints create an easy path for forged ARP replies to reach peers. Layer 2 hardening matters here because the vulnerability exists only where hosts can hear and accept each other’s broadcasts.

Defenders usually reduce risk with port security, DHCP snooping, dynamic ARP inspection, switch isolation, and segmentation that limits who can share a broadcast domain. The Layer 2 Attacks Guide and the MITRE ATT&CK T1557 Adversary-in-the-Middle guide both map these controls to the attack path.

When organisations need a broader defensive playbook for suspicious devices or implants on a LAN, the Rogue Device on Network Playbook is useful because ARP poisoning often presents as an unknown or unauthorized node on the segment.

Detection, Response, and Recovery After Poisoning

Detection usually depends on noticing inconsistent IP-to-MAC mappings, duplicate IP claims, unexpected gateway MAC changes, or unusual ARP reply rates. Because the attack is noisy at the packet level but subtle at the endpoint level, network telemetry and switch-side inspection are more reliable than endpoint symptoms alone.

Response should focus on isolating the suspicious port or device, restoring correct ARP state, and confirming whether any traffic was intercepted or altered. If the attacker successfully sat in the path, organisations may need to review session integrity, reset exposed credentials, and confirm whether higher-layer protections were bypassed by traffic relaying rather than packet decryption. The Man-in-the-Middle Attacks Guide also helps frame post-incident validation and detection logic.

For environments where ARP poisoning is only one piece of a wider adversary-in-the-middle pattern, ATT&CK mapping is useful for hunting related behaviours such as name-resolution poisoning and relay attempts. That makes compromise review broader than the ARP table itself, because the attacker may also have used adjacent spoofing or forwarding techniques.

Risk and Threat Considerations

ARP cache poisoning matters because it converts a local network trust assumption into a traffic-control opportunity for an attacker. The immediate risk is interception or denial of service, but the deeper issue is that any device sharing the broadcast domain can be manipulated into sending sensitive traffic to the wrong MAC address.

Failure mechanism: ARP lacks cryptographic authentication, so forged replies can overwrite legitimate address mappings before hosts notice the deception.

Impact: Attackers can eavesdrop, redirect, degrade, or block traffic, and they may also use the position to relay authentication exchanges or capture session material.

Practitioner Guidance

What to watch for: Treat ARP poisoning as a Layer 2 control problem, not just an endpoint anomaly. The most effective defensive decisions usually involve segmentation, switch enforcement, and rapid identification of rogue ports rather than relying on host-based alerts after the fact.

Governance implication: Network owners should decide which segments are allowed to remain broadcast-heavy and where protections such as dynamic ARP inspection, DHCP snooping, and port security are mandatory. In practice, the question is not whether ARP poisoning can happen, but whether the environment makes it easy enough to succeed repeatedly.

Related resources from NHI Mgmt Group

• Guide: Web Cache Poisoning and Cache Deception Guide
• How should security teams test whether a cache key is safe from poisoning in practice?
• What do teams get wrong about detecting cache poisoning and related cache key flaws?
• What happens when a cache poisoning flaw is chained with a reflected client-side gadget?
• What should security teams do first when auditing for web cache poisoning risk?