ARP poisoning is a network attack that tricks devices into sending traffic to the wrong MAC address. The attacker forges Address Resolution Protocol replies to overwrite cache entries, enabling interception, redirection, or disruption of local network traffic, often as a step toward credential theft or man-in-the-middle access.
How ARP Poisoning Works
ARP poisoning succeeds because Address Resolution Protocol has no built-in trust model for replies. On a local network, an attacker can race legitimate mappings and cause hosts to associate an IP address with the attacker’s MAC address instead of the real device.
The attack is usually local to the broadcast domain, which is why it is especially effective on flat internal networks and poorly segmented VLANs. It does not need to break encryption to be useful, because it can target where packets flow before higher-layer protections are applied.
Why ARP Poisoning Is Dangerous
Once a cache entry is overwritten, traffic can be silently redirected through the attacker, dropped, or relayed onward. That makes ARP poisoning a practical enabler for interception, credential capture, session theft, and selective denial of service.
The danger is not only data exposure. A successful man-in-the-middle position can let an intruder observe internal services, manipulate unprotected traffic, or exploit trust relationships between hosts that were assumed to be talking directly to each other.
How Organisations Detect Exposure
Exposure starts with knowing where flat Layer 2 segments still exist and which systems depend on them. Inventory and network topology matter here, because unmanaged endpoints, guest networks, and legacy subnets are common places for spoofed ARP traffic to succeed.
Operators should watch for inconsistent IP-to-MAC mappings, duplicate address resolution events, or sudden changes in the MAC address associated with critical infrastructure. These are not proof of compromise by themselves, but they are strong signs that local network trust may be being abused.
Controls That Reduce ARP Poisoning Impact
The most effective controls narrow the attacker’s ability to influence local traffic paths. Network segmentation, switch protections such as dynamic ARP inspection where supported, and static bindings for highly sensitive hosts can reduce the chance that forged replies will be accepted.
Encryption still matters because it limits what an attacker can learn after interception. Even if a relay position is achieved, TLS, VPNs, and strong service authentication can reduce the value of the attack and constrain lateral movement.
Risk and Threat Considerations
ARP poisoning is dangerous because it attacks a basic trust assumption in local networking: that address-to-MAC mapping is stable and honest. Once that assumption fails, an attacker can position themselves between hosts, observe sensitive traffic, or disrupt critical internal services without needing perimeter compromise.
Failure mechanism: The attacker forges ARP replies that overwrite cache entries, then uses the resulting misdirection to intercept, relay, or drop packets on the local segment.
Impact: The likely consequences are credential exposure, session hijacking, traffic tampering, and intermittent outages that are difficult to distinguish from ordinary network instability.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1557 — Adversary-in-the-Middle | ARP poisoning enables local traffic interception and redirection via man-in-the-middle positioning. |
| Recommendation — Map suspicious ARP spoofing activity to T1557 and hunt for interception or relay behavior on the affected segment. | ||
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | ARP poisoning subverts intended network traffic paths and flow controls between internal hosts. |
| SI-4 — System Monitoring | Detection depends on identifying anomalous ARP mappings and suspicious local-network behavior. | |
| Recommendation — Enforce AC-4 to constrain which systems can exchange traffic and reduce unauthorized redirection paths. Use SI-4 to alert on abnormal address-resolution changes and signs of local network interception. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | ARP poisoning is mitigated through switch controls, segmentation, and hardened local network design. |
| Recommendation — Harden network infrastructure to limit spoofed Layer 2 traffic and protect critical subnets. | ||
| NIST CSF 2.0 | PR.AA-05 — Network Integrity and Segmentation | The attack abuses weak local-network trust and benefits from flat segments. |
| DE.CM-01 — Networks and Network Services Monitored | ARP poisoning is often detected through anomalous local network behavior and mapping changes. | |
| PR.DS-02 — Data-in-Transit Protected | Encryption limits the value of intercepted traffic after a successful man-in-the-middle position. | |
| Recommendation — Segment networks and protect local trust boundaries to reduce ARP spoofing exposure. Monitor network services for unexpected ARP mapping changes and traffic redirection indicators. Protect data in transit so intercepted ARP-rerouted traffic remains unreadable. | ||
Practitioner Guidance
What to watch for: Treat ARP poisoning as a network trust failure, not just a nuisance. If a host suddenly changes the MAC address associated with a gateway or critical server, investigate the segment, the switch path, and any unmanaged device that could be injecting replies.
Governance implication: The control objective is to reduce dependence on unauthenticated Layer 2 trust. Segmentation, hardening, and encrypted application traffic are most effective when they are designed together rather than applied as isolated safeguards.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org