Sundarban Gas Company Limited (SGFL) Assistant General Engineer Exam: 2021 (BUET)প্রশ্ন ও সমাধান

ARP spoofing exploits the fact that ARP has no authentication - any host can broadcast a fake ARP reply, and other devices will simply trust and cache it, associating an attacker's MAC address with someone else's IP.

sequenceDiagram
    participant V as Victim
    participant A as Attacker
    participant G as Gateway/Router
    Note over V,G: Normal: Victim talks directly to Gateway
    A->>V: Forged ARP reply - Gateway IP is at Attacker MAC
    A->>G: Forged ARP reply - Victim IP is at Attacker MAC
    V->>A: Victim traffic, thinks it is reaching the Gateway
    A->>G: Attacker forwards or inspects/modifies the traffic
    G->>A: Response traffic
    A->>V: Attacker forwards response - invisible Man-in-the-Middle

• Why it enables MITM: once both the victim's and the gateway's ARP caches are poisoned to point to the attacker's MAC address, all traffic between them physically flows through the attacker first, who can silently read, log, or modify it before forwarding, without either party noticing anything is wrong.
• Consequences: session hijacking, credential sniffing, DNS/content injection, or simply denial of service if the attacker drops traffic instead of forwarding it.
• Defence: static ARP entries for critical hosts, Dynamic ARP Inspection (DAI) on managed switches, and encrypting traffic end-to-end (HTTPS/VPN) so even an intercepted stream is unreadable.

Exam takeaway: ARP spoofing poisons the ARP cache of victim and gateway with the attacker's MAC address for each other's IP, silently routing all their traffic through the attacker - the classic setup for a Man-in-the-Middle attack on a LAN.