Watch ARP poisoning happen in a closed lab

short · 45 min · Objective 4.2

Task

Observe an on-path attack against your own lab hosts, see what it does to the ARP cache, and then detect it. The point is detection: you need to know what the symptom looks like, because the attack is silent from the victim side.

Steps

  1. From Host A record the state: ip neigh show 192.168.10.1. Write down the router real MAC address. This is your baseline: the correct IP-to-MAC map before anyone tampers with it.
  2. On Host C, the attacker position and also yours, enable forwarding so that traffic still flows and the attack stays invisible: sudo sysctl -w net.ipv4.ip_forward=1.
  3. On Host C, start poisoning Host A's cache so the router's address maps to Host C: sudo arpspoof -i eth0 -t 192.168.10.10 192.168.10.1. Leave it running in that terminal.
  4. Back on Host A, look again: ip neigh show 192.168.10.1. The MAC address for the gateway has changed to Host C's MAC, and nothing warned you. From here every packet Host A sends to the internet goes through the attacker first. This is what "on-path" means in practice.
  5. Now detect it. On Host A, list the whole cache and look for one MAC claimed by more than one IP — the signature of a machine impersonating the gateway: ip neigh show | awk '{print $5}' | sort | uniq -d. Then stop arpspoof on Host C (Ctrl-C) and confirm Host A's cache repairs itself.

Verify

ip neigh show
ip neigh show | awk '{print $5}' | sort | uniq -d
sudo tcpdump -i eth0 -n -c 20 arp

The first command shows the gateway pointing at the attacker's MAC while the attack runs. The second is the detection you would actually deploy: it prints any MAC address that appears against more than one IP, and a hit is the poisoning. The tcpdump line shows the unsolicited ARP replies arriving — a gratuitous reply for 192.168.10.1 from Host C's MAC, repeated, which no normal host sends.

Notes

The defences are all about not trusting ARP blindly. Dynamic ARP Inspection on a managed switch validates ARP packets against the DHCP snooping table and drops the forged ones — the real fix in a production network. Port security limits which MACs a port will accept, which contains a rogue device. Static ARP entries for critical hosts like the gateway stop the cache being overwritten at all, at the cost of maintenance.

Notice the attack needed no password and broke no encryption — it exploited a protocol that was designed with no authentication at all. That is why detection matters more here than prevention: on an unmanaged flat network there is often nothing stopping it, only something watching for it.