ARP Poisoning / MITM
Security
Overview
An attacker can advertise a forged IP-to-MAC mapping because basic ARP lacks authentication. Traffic may be redirected through the attacker. DAI with accurate bindings can reject inconsistent advertisements; encryption and endpoint verification reduce interception risk but do not restore a poisoned L2 mapping by themselves.
Protocol stages
- 1Forged ARP
- 2Cache change
- 3Traffic diversion
- 4Binding validation
- 5Defense
Interactive exercise
Knowledge check
Gateway 10.0.0.1 is bound to MAC AA. An untrusted port advertises it as MAC BB. Under DAI with the correct binding?
Educational model — not real hardware, traffic or official certification.