What Is ARP Spoofing?

ARP spoofing sends false address resolution messages on a local network so that traffic intended for one device is delivered to the attacker instead. It is a local-network technique for achieving a man-in-the-middle position.

It works because the protocol has no authentication. Any device on the segment can claim any address, and other devices believe the most recent claim.

What it requires and what it yields

It requires presence on the same network segment — a compromised host, a connected device, or wireless access. That constraint is why segmentation matters so much to its reach.

It yields interception of traffic between devices on that segment, including to the gateway, which means everything leaving the segment. Where traffic is unencrypted it is readable and modifiable; where encrypted, the attacker can still observe metadata and attempt downgrade.

Why it remains relevant

Internal traffic is frequently unencrypted, on the assumption that the internal network is trusted. Management protocols, legacy applications, internal web services and operational technology communications commonly carry no encryption at all.

Those are exactly the targets. A technique limited to one network segment is serious when that segment contains industrial controllers or an internal application handling credentials in clear text.

Switch-level protections

Dynamic inspection features on managed switches validate address resolution messages against known bindings and drop forged ones. Port security limits which hardware addresses may appear on a port.

Static entries for critical devices remove the ability to override them. These are configuration on equipment most organisations already own, and they are commonly left unconfigured.

Encryption removes the payoff

The durable answer is not preventing interception but making it worthless. Internal services using transport encryption, management protocols over encrypted channels, and mutual authentication where practical.

That is the practical content of applying zero trust internally: traffic is protected regardless of the network it crosses, so a device on the segment gains nothing by being there.

Detection

Duplicate address mappings, where two devices claim the same address. A single hardware address associated with many network addresses. Unusual volumes of resolution traffic.

Switch logging reports much of this where the inspection features are enabled. Without them, detection depends on monitoring the segment directly, which most organisations do not do internally.

Operational technology is the worst-affected case

Industrial and building control networks frequently run protocols with no authentication or encryption at all, on flat segments, with equipment that cannot be patched or replaced for years. A device on that segment can read and alter control traffic.

Because the endpoints cannot be changed, the entire control is the network: strict segmentation, tightly specified permitted flows, monitoring of what appears on the segment, and physical restriction of who can connect to it at all.

It is also worth remembering that wireless access is presence on the segment. A guest network bridged onto an internal one, or a corporate wireless network without client isolation, gives anyone within radio range the position this technique requires without their ever entering the building.

Where to start

Establish whether your internal management interfaces and applications use encryption. Anything carrying credentials in clear text on an internal segment is exposed to anyone who reaches that segment.

See 802.1X authentication. GuardsArm runs internal penetration testing.