ARP poisoning
termnetworkingsecurity
Answering the local network's address resolution requests with a lie, so that traffic for another machine is delivered to you instead.
Address resolution was specified in 1982 to solve one problem - find the hardware address for a protocol address - and it solved it by asking the whole segment and believing whatever came back. There is no authentication, no state, and no way for the asker to tell a legitimate reply from a crafted one; a machine can also send unsolicited replies that hosts will cache. Everything else follows. Placing yourself between two hosts on the same segment, or between a host and its default gateway, requires only that you answer first and keep answering. Switching never addressed this, because a switch forwards on the basis of the same learned mappings. The mitigations are all switch features and all optional: dynamic ARP inspection validating replies against DHCP bindings, DHCP snooping to build those bindings, port security limiting addresses per port, and 802.1X to authenticate the device before it may speak at all. Forty-four years after the specification the protocol is unchanged, and the defence remains a configuration decision somebody has to make.
Also known as: arp poisoning, arp spoofing, arp cache poisoning, arp poison routing