ARP spoofing
/ arp: rhymes with 'harp' /
On a local network, when your computer wants to send to another machine, it knows the target's IP address but needs its hardware (MAC) address to actually deliver the frame. It finds out by broadcasting an ARP request — 'who has IP 192.168.1.5? tell me your MAC' — and trusts whatever answer comes back, caching it. The catch: ARP has no authentication whatsoever. ARP spoofing exploits this by sending forged ARP replies, tricking machines into associating an IP address with the attacker's MAC address.
Here's how it plays out. The attacker sends the victim a forged ARP reply claiming 'the router's IP is at my MAC address,' and sends the router a forged reply claiming 'the victim's IP is at my MAC address.' Because nothing verifies these claims, both update their ARP caches accordingly (this is why it's also called cache poisoning). Now the victim's traffic destined for the router goes to the attacker, and vice versa — the attacker sits squarely in the middle of the conversation. They can then quietly forward the traffic on (a man-in-the-middle, reading and possibly altering it) or simply drop it (a local denial of service).
Why it matters: ARP spoofing is one of the most common ways an attacker on the same local network — the same Wi-Fi, the same office LAN — establishes a man-in-the-middle position. It works only on the local link (ARP doesn't cross routers), which is precisely why being on an untrusted shared network is risky. The defenses are layered: switch features like Dynamic ARP Inspection can validate ARP replies, and static ARP entries help on critical machines. But the most important practical defense is end-to-end: even if an attacker intercepts your traffic via ARP spoofing, HTTPS/TLS means they get only ciphertext and can't impersonate the server without a valid certificate.
On office Wi-Fi, an attacker sends forged ARP replies so your laptop thinks the attacker's MAC is the router, and the router thinks the attacker's MAC is yours. All your traffic now flows through the attacker, who relays it onward — a man-in-the-middle. But your HTTPS sessions still show only ciphertext, and a certificate check blocks impersonation.
Poison the ARP caches, become the middleman on the LAN.
ARP spoofing works only on the local link (it doesn't cross routers), which is why untrusted shared Wi-Fi is risky. Crucially, it intercepts traffic but can't break HTTPS — the attacker still can't forge a valid certificate.