ARP spoofing is the trick of sending forged ARP messages on a local IPv4 network so other devices map an IP address to the attacker’s MAC address. ARP is simple and mostly trust based. Hosts accept the most recent reply and update their ARP cache, even if they did not ask for it. An attacker takes advantage of this by broadcasting fake replies. The result is a poisoned cache that points traffic to the wrong place. The classic target is the path between a host and its default gateway. The attacker tells the host ‘the gateway’s IP is at my MAC’ and tells the gateway ‘the host’s IP is at my MAC’. Traffic then flows through the attacker. That enables man-in-the-middle interception, alteration, or simple black-holing. Other aims include redirecting specific flows, stealing session cookies on unencrypted services, or knocking devices offline. Scope is limited to a single broadcast domain. ARP does not cross routers, so the attacker must be on the same VLAN or Wi-Fi network as the victim. The method works because ARP uses broadcasts and has no built-in authentication. Gratuitous ARP makes it even easier, since unsolicited replies are valid in the protocol. Typical signs include frequent unsolicited ARP traffic, sudden changes in the observed MAC address for the gateway IP, duplicate IPs mapping to different MACs across short periods, and OUIs that do not match expected vendors. Logs may show connections resetting or moving to new L2 neighbours without a change in IP.
