ARP Spoofing

What it is

ARP spoofing forges local-network announcements that associate an IP address with the wrong hardware address. ARP helps devices find a neighbor or gateway on an IPv4 local network, but basic ARP has no built-in authentication. The attack is normally local in scope; it is not a universal way to intercept any remote website.

How it works

A device on the relevant network sends misleading address mappings. Other devices may then send gateway or peer traffic to the attacker, who can relay, drop, or observe it. The ability to read protected content still depends on encryption and endpoint security; redirecting packets does not automatically defeat TLS.

How people get tricked

There may be no human interaction because devices process announcements automatically. A shared local network is treated as trusted even though one member or device may be compromised.

Example scenario

A compromised machine claims to be the local gateway. Nearby traffic passes through it, but properly validated encrypted connections remain protected while plaintext application traffic is exposed.

Warning signs

• Unexpected changes to gateway hardware-address mappings.
• Conflicting address announcements or switch-security alerts.
• Local connectivity interruptions alongside unexplained traffic paths.

If it happens to you

Locate and isolate the offending device, restore trusted mappings, and review network controls. Investigate exposed plaintext data and credentials. Involve the network administrator rather than making ad hoc changes that can disrupt legitimate address assignment.