ARP Spoofing (also called ARP poisoning) is a network attack where an attacker sends fake ARP messages to link their MAC address with the IP address of a legitimate device (like the gateway). This allows the attacker to intercept, modify, or block network traffic.
Computer A wants to talk to Computer B (knows IP, needs MAC address)
"Who has 192.168.1.5? Tell 192.168.1.10"
"192.168.1.5 is at MAC: AA:BB:CC:DD:EE:FF"
Device stores IP-MAC mapping in ARP cache, sends data directly
Attacker sends gratuitous ARP replies claiming to be the gateway or another host, poisoning victim's ARP cache.
"192.168.1.1 (gateway) is at MAC: ATTACKER-MAC" → Victim
Now thinks attacker's MAC = gateway IP
All victim's internet traffic goes through attacker first (Man-in-the-Middle)
Can sniff passwords, inject malware, or deny service
Man-in-the-Middle via ARP Cache Poisoning