Glossary
ARP Spoofing
On your local network, computers find each other using ARP. ARP spoofing tricks computers into sending their traffic through the attacker's machine first. It's like redirecting all office mail through a spy's desk before it reaches the recipient.
What is ARP Spoofing?
A technique where an attacker sends fake ARP messages over a local network to link their MAC address with a legitimate IP address, enabling interception of network traffic.
Why Should You Care?
ARP spoofing is a foundational attack in local network compromise—once an attacker can intercept traffic, they can harvest credentials, capture unencrypted data, perform man-in-the-middle attacks, or redirect users to malicious sites without ever touching the perimeter. Organizations with unencrypted internal traffic (legacy systems, SCADA networks, internal services) face especially high risk, as attackers on the same network segment can transparently steal data flowing through compromised systems.
Is your business exposed?
Real-World Example
An attacker who gains a foothold on a local network can send forged ARP responses claiming to be the default gateway, causing other machines to route their traffic through the attacker's system. From that position, the attacker can read or modify unencrypted traffic—capturing credentials, intercepting internal service calls, or altering data in transit. In operational technology environments such as utilities and manufacturing, this technique can be used to observe or tamper with commands sent to industrial control systems.
How to Protect Against ARP Spoofing
- 1.
Use static ARP entries for critical servers
- 2.
Implement network encryption (802.1X)
- 3.
Deploy ARP spoofing detection tools
Related Terms
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required