ARP Cache Poisoning

Address Resolution Protocol (ARP) links an IPv4 address to a device's MAC address on a local network. ARP cache poisoning (also called ARP spoofing) is an attack where someone sends fake ARP messages so devices store the wrong IP-to-MAC mapping. ARP applies to IPv4 networks; IPv6 uses Neighbor Discovery Protocol (NDP), where similar attacks are usually called NDP spoofing or neighbor cache poisoning.

In a common scenario, the attacker tells a victim that the attacker's MAC address belongs to the network gateway, and tells the gateway that the attacker's MAC address belongs to the victim. Both systems then send traffic to the attacker by mistake. This lets the attacker read, alter, or block traffic before passing it on.

Legitimate, or false alarm?

In large corporate networks, monitoring systems can sometimes raise false alarms for ARP poisoning. Legitimate changes, such as DHCP renewals, failover events, load balancers, virtual machine migrations, or endpoint MAC randomization, can appear suspicious even when no attack is present. Analysts should confirm alerts with multiple signals (for example, switch logs and endpoint behavior) before declaring an incident.

What can home users do?

•Avoid public Wi-Fi for sensitive tasks—Coffee shops and airport networks are the most common places for ARP poisoning attacks. Use mobile data instead.

•Use a VPN—A VPN encrypts your connection so an attacker on the same network cannot read your traffic even if they intercept it.

•Keep your devices updated—Software updates fix security vulnerabilities that attackers rely on to carry out attacks.

•Use a security solution—ESET products detect and block ARP poisoning attempts automatically via Network Attack Protection. Users can customize network attack detection behavior in Advanced IDS settings.

What can business users do?

•Require a VPN for remote and traveling employees—A VPN ensures that work traffic is encrypted even on untrusted networks.

•Train employees—Teach staff to recognize phishing and social engineering attempts, avoid sensitive accounts on public or guest Wi-Fi, and report unexpected network warnings.

•Contact IT—If you notice unusual network behavior or unexpected login prompts, report it to your IT department immediately.