ARP cache poisoning is an attack in which a device accepts a false association between an IPv4 address and a hardware address, usually a MAC address, into its local ARP cache. That can redirect traffic on the same local network through an attacker, creating an opportunity to intercept or manipulate it.
What ARP cache poisoning means
The Address Resolution Protocol (ARP) helps devices on an IPv4 local network find the link-layer address, such as an Ethernet MAC address, associated with an IP address. Devices keep these associations in an ARP cache so they can send later traffic without repeatedly asking. The protocol specification is RFC 826.
As an Amazon Associate I earn from qualifying purchases.
ARP does not authenticate these mappings. As MITRE ATT&CK’s description of T1557.002 explains, a device may add or update an incorrect entry. Cisco defines the attack plainly: “Sending false information to an ARP cache is known as ARP cache poisoning.”
Recommended Free Tools
How ARP spoofing works
- A device needs a local address. When it needs to send traffic to an IPv4 address on its local segment, it can broadcast an ARP request asking which MAC address belongs to that IP.
- An attacker sends a false answer. A forged ARP response or gratuitous ARP message claims that the target IP address is associated with the attacker’s MAC address.
- A victim accepts the false mapping. If the device updates its ARP cache with that claim, it sends frames intended for the target IP to the attacker’s machine instead.
- The attacker may relay or alter traffic. Cisco’s documented scenario describes poisoning the caches of two communicating hosts, and the switch in that example, to place the attacker in the path. The attacker can forward traffic onward and act as a man in the middle. See Cisco’s guide to ARP spoofing attacks.
What an attacker can—and cannot—do
A successful false mapping can expose traffic that passes through the attacker and may support follow-on sniffing or manipulation of transmitted data. The result depends on the attacker’s network position, which devices accept the forged mapping, and whether traffic is relayed onward.
#1 Best Overall
ARP poisoning does not automatically reveal the contents of encrypted sessions. Encryption can keep intercepted data unreadable, although it does not by itself stop a device from being redirected or prevent every form of traffic manipulation.
The described attack concerns devices on the same local subnet or broadcast domain. It is not a method for rewriting arbitrary Internet routing tables.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to reduce ARP-poisoning risk
| Measure | What it does | Coverage and operational fit |
|---|---|---|
| Dynamic ARP Inspection (DAI) | Validates ARP packets and can drop invalid packets when enabled and properly configured. | A switch-level control for supported platforms; check the specific switch and network configuration. Cisco documents the feature for IOS XE 17.18.1 in its Dynamic ARP Inspection guide. |
| DHCP snooping with binding validation | Can provide trusted IP/MAC-to-switch-port bindings for DAI to use when identifying bogus ARP traffic. | Requires suitable switch support and trustworthy DHCP-derived bindings; MITRE recommends considering it together with DAI. |
| Encryption | Limits what an interceptor can read from protected sessions. | Protects data confidentiality, but does not prevent false ARP bindings or all redirection and manipulation. |
| Static ARP entries | Fixes selected IP-to-MAC mappings rather than relying on dynamic updates. | Can be practical for a small number of systems, but maintaining entries may be infeasible at larger scale. |
| Network intrusion prevention and traffic filtering | Can help identify or block suspicious network activity. | Network-level controls; deployment should reflect the organization’s topology and monitoring capability. |
These measures address different parts of the risk: DAI and binding validation aim to prevent bogus mappings, while encryption limits the value of traffic that is intercepted. No single option is a universal fit; the cited guidance does not establish a controlled cost or effectiveness ranking across them. For a network using its own managed switches, verify platform support and configuration requirements before relying on DAI.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Best Value
- Used Book in Good Condition
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
