ARP-Based Attacks: The Overlooked Threat Inside Your Network

ARP (Address Resolution Protocol) is a foundational part of how local networks function. It resolves IP addresses to physical MAC addresses so devices can communicate on a LAN. However, this critical process was designed without security in mind. ARP-based attacks exploit this flaw to launch man-in-the-middle attacks, steal data, impersonate hosts, and escalate into full compromise. In this post, we’ll break down what ARP spoofing is, how attackers execute it, what defenders can do to stop it, and why it’s more relevant than ever in today’s environment.

What is ARP and Why is it Vulnerable
ARP operates at Layer 2, resolving IP addresses to MAC addresses using broadcast requests. When a host wants to talk to another, it sends a broadcast asking, “Who has this IP?” The device with that IP replies with its MAC address. The initiating device stores the result in its ARP cache.

The problem: ARP has no authentication. Any device can send an ARP reply. Devices often accept the latest ARP information without verifying it, making it easy for attackers to poison the cache with forged replies. This is the core of ARP spoofing.

How ARP Spoofing Works
An attacker sends forged ARP replies to victims and to the default gateway. The victim now thinks the attacker’s MAC address is associated with the gateway’s IP, and the gateway thinks the attacker’s MAC is tied to the victim’s IP. This sets up a man-in-the-middle situation. The attacker intercepts, modifies, or blocks traffic between the two endpoints.

This form of attack does not require ICMP, DNS, or firewall exploitation. It only requires local access and the ability to send ARP packets on the subnet.

The Attacker’s Perspective
From the attacker’s viewpoint, ARP spoofing is incredibly low-risk and high-reward. The attack requires no zero-day exploits or privilege escalation. It works against nearly every operating system on the planet because they all use ARP and trust it by default.

If physical access is available, an attacker can plug in a small device like a Raspberry Pi or LAN Turtle and begin spoofing within seconds. Even with network segmentation, many corporate networks rely on default switch configurations with no protections like port security, DAI, or 802.1X. The attacker can map the subnet, find high-value targets, impersonate key infrastructure like DNS servers, and siphon off credentials.

Common tools include arpspoof, Bettercap, and ettercap. These can automate discovery, poisoning, traffic capture, and even credential extraction. When combined with tools like Responder, the attacker can harvest NTLM hashes and relay them to gain access to other systems.

Even if a target host blocks pings or restricts access, tools like arpping still elicit a MAC response, allowing detection of live systems via ARP. This bypasses traditional ping sweeps and can be done silently.

The Defender’s Perspective
Defending against ARP spoofing isn’t as simple as enabling a firewall or antivirus. ARP traffic is Layer 2 and trusted by the OS. Most operating systems do not offer native controls to validate ARP replies or prevent cache poisoning.

There are, however, effective mitigation techniques at multiple layers:

Switch-level protections – Enabling Dynamic ARP Inspection (DAI) validates ARP replies against DHCP snooping tables. 802.1X port authentication restricts access to authorized devices. Port security limits the number of MAC addresses on a port.
Monitoring and detection – Deploy tools like arpwatch, Wireshark, and endpoint security platforms that can alert on ARP table changes or duplicate MACs. EDR solutions may include MITM detection as well.
Host hardening – On critical systems, static ARP entries can prevent poisoning for specific hosts, though this doesn’t scale well. Disabling LLMNR and NetBIOS reduces the attack surface for related spoofing methods.
Segmentation – Isolating sensitive systems on VLANs limits the spread of ARP-based attacks. An attacker on one VLAN won’t easily poison another.
Shutting down unused ports – Physically securing ports or disabling unused ones ensures attackers can’t plug in rogue hardware without detection.

Without these layers, even a simple attacker with a USB-to-Ethernet adapter can compromise credentials and visibility on the network.

Why Windows Workstations Are Vulnerable
Even with host firewalls enabled, Windows systems will still respond to ARP requests. The ARP process happens before IP filtering, so the Windows firewall doesn’t block it. This means attackers can gather MAC and IP info and poison the ARP cache regardless of ICMP settings or firewall rules.

There are no native Windows settings to block ARP traffic or restrict dynamic updates to the ARP cache. Third-party firewalls or EDR platforms may offer protection, but it is often overlooked in default deployments.

Recon Without ICMP: The Role of Arpping
Arpping allows an attacker to probe devices without using ICMP ping. This is critical because many administrators mistakenly believe that blocking ping (ICMP echo) will prevent discovery. With arpping, an attacker simply sends ARP requests directly and receives MAC replies from live hosts. This allows them to:

Build a map of active hosts
Confirm which IPs are in use
Avoid detection by ICMP-based scanners

For defenders, this means that ICMP restrictions alone are insufficient. ARP requests cannot be blocked by traditional Windows Firewall, so detection and infrastructure controls must be prioritized.

Defense in Depth Against ARP Attacks
No single solution will stop ARP-based attacks. Like any part of a resilient security architecture, defense against ARP poisoning requires multiple layers:

DAI to validate packets
802.1X to restrict access
Port security to limit rogue devices
VLANs to isolate sensitive traffic
Host-level logging and detection
Physical port lockdown

Organizations should regularly audit switch configurations, monitor ARP changes, and test detection capabilities through internal red team assessments. A security solution that ignores Layer 2 is incomplete.

ARP-based attacks are among the most silent and dangerous threats on any local network. They require no privilege escalation, no software exploit, and no special access beyond plugging into a wall jack or gaining Wi-Fi access to a LAN. Once active, they allow adversaries to intercept traffic, redirect sessions, extract credentials, and impersonate systems.

Despite their simplicity, ARP spoofing and related attacks remain common because most environments don’t deploy proper switch-level controls like DAI or 802.1X. Windows workstations are vulnerable by default, and host firewalls offer no defense at Layer 2.

Defenders must stop underestimating the power of Layer 2 threats. Implementing port-based access control, ARP validation, and device monitoring can stop these attacks before they start. The goal isn’t just to detect ARP spoofing—it’s to make your network hostile to any rogue device that dares to try.