X-ARP
arpspoof
Classic ARP cache poisoning tool from the dsniff suite, used to redirect traffic on a switched LAN segment for on-path testing.
OVERVIEW
arpspoof, part of the classic dsniff suite (github.com/simsong/dsniff, originally monkey.org/~dugsong/dsniff), forges ARP replies to make a target host associate the attacker's MAC address with another host's IP address (typically the default gateway), causing the target's traffic meant for that IP to be sent to the attacker instead. Run against both directions of a conversation, it places the attacker fully on-path between two hosts on the same switched LAN segment.
It's a decades-old technique that still works on most flat, unhardened LAN segments because ARP has no authentication built in — any host can claim to own any IP on the local segment. It's typically paired with IP forwarding and a packet capture or relay tool (tcpdump, Wireshark, or the rest of dsniff) to actually inspect or modify the intercepted traffic, since arpspoof itself only performs the redirection.
USE CASES
Practical use cases
- 01
Placing yourself on-path between a host and its default gateway to capture unencrypted traffic on a flat LAN.
- 02
Demonstrating that a network segment lacks ARP-spoofing protections (dynamic ARP inspection, port security) as a finding.
- 03
Redirecting traffic through an attacker box for relay into another tool (e.g. Responder, an NTLM relay, or a packet analyzer).
- 04
Validating that a client's switch-level mitigations (DAI, static ARP entries) actually block the attack after remediation.
QUICK START
On an internal engagement with explicit segment-wide authorization, to place yourself on-path between two hosts on a switched LAN for traffic interception or relay testing.
- Get explicit written authorization scoped to this specific LAN segment — ARP poisoning affects every host on the broadcast domain, not just a chosen target pair.
- Install dsniff (arpspoof is part of the suite) on a box connected to the target segment.
- Enable IP forwarding on the attacker box so redirected traffic still reaches its real destination.
- Run arpspoof against the target and the gateway (or both directions of the conversation) to place yourself on-path.
- Capture or relay the intercepted traffic with a separate tool, then stop the poisoning and restore normal ARP tables when done.
arpspoof -i eth0 -t 10.10.10.50 10.10.10.1BEFORE YOU RUN IT
What to check before running it
ARP poisoning affects the entire broadcast segment, not just the intended target pair — get written scope covering the whole segment, since other hosts' traffic can be disrupted or intercepted as a side effect.
Forgetting to restore ARP tables (or a crash mid-attack) can leave the target unable to reach the gateway, causing a real outage — always plan a clean stop and verify connectivity is restored.
Switches with dynamic ARP inspection or port security will detect or block this outright; document whether the segment had those controls as part of the finding either way.