ARP spoofing
ARP spoofing (also called ARP poisoning) is an attack on a local IPv4 network where a device sends forged Address Resolution Protocol replies, claiming to own an IP address that actually belongs to another host, such as the router. Because ARP has no built-in authentication, other devices on the same subnet update their ARP tables to trust the forged mapping, which lets the attacker intercept, modify, or drop traffic meant for someone else -- a classic man-in-the-middle setup. It only works within a single broadcast domain (the attacker must already be on the same LAN or Wi-Fi network), which limits it to insider threats, compromised devices, or open/shared networks. Switches with dynamic ARP inspection, static ARP entries for critical hosts, and network segmentation are the standard mitigations; IPv6 networks use Neighbor Discovery Protocol instead, which has its own, different spoofing risks.
By AdminKit team, Netbase JSC · Updated