6.5.4 Poison Arp And Analyze With Wireshark

The Packet That Lets You Hijack a Network (And How to Catch It)

Picture this: you're on a coffee shop Wi-Fi, typing away, when suddenly your browser redirects to a login page you didn't ask for. Your traffic is being intercepted. What happened?

Somewhere between your laptop and the router, someone sent out a tiny, malicious packet called a gratuitous ARP. It's one of the oldest tricks in the book, and it still works. ARP spoofing — sometimes called ARP poisoning — is a network attack where a bad actor tricks devices on a local network into sending their traffic through the attacker's machine instead of the real gateway.

And here's the thing: if you know what to look for, you can catch it with Wireshark in under a minute.

What Is ARP, Really?

Before we dive into the poison, let's talk about the medicine Worth knowing..

ARP stands for Address Resolution Protocol. And 1. It's the quiet janitor of your local network, working behind the scenes to map IP addresses (like 192.168.1) to MAC addresses (the physical hardware address burned into every network card, like 00:1a:2b:3c:4d:5e) Still holds up..

Here's how it normally works: your computer wants to send data to 192.168.So naturally, 1. 1 (probably your router). Still, it doesn't know the router's MAC address, so it broadcasts an ARP request: "Hey, who has 192. 168.1.Day to day, 1? On the flip side, tell 192. That said, 168. On top of that, 1. So 100. " The router replies: "That's me! My MAC is 00:1a:2b:3c:4d:5e." Your computer stores that in its ARP cache and moves on with its life The details matter here..

Simple, right? That's the problem.

Why ARP Has No Built-In Security

ARP was designed in the 1970s, back when networks were small and everyone knew each other. There's no authentication, no signature, no verification. If you send out an ARP packet claiming to be the router, devices will usually believe you.

That's the vulnerability. And it's the foundation of every ARP spoofing attack.

Why ARP Spoofing Still Works (And Why It Matters)

You might think: "This is ancient tech. Surely it's been fixed by now."

It hasn't.

Here's why it still matters:

• It's a man-in-the-middle attack vector. Once you're in the middle, you can sniff traffic, steal credentials, inject malware, or just watch what people are doing.
• It works on any unsecured local network. Coffee shops, hotels, office LANs — if there's no port security or dynamic ARP inspection, you're vulnerable.
• It's trivial to execute. Tools like arpspoof or ettercap automate the whole process. You don't need to be a hacker wizard.
• It's hard to detect without the right tools. Most users never notice anything is wrong until it's too late.

I've seen this play out in real life more times than I can count. A small business owner calls me because their internet is "acting weird." Ten minutes with Wireshark, and there it is — a rogue device sending gratuitous ARP packets, redirecting half the office traffic through a laptop someone left unattended Turns out it matters..

How ARP Spoofing Works (Step by Step)

Let's break down what actually happens during an attack.

The Attack Flow

1. The attacker identifies targets. They pick a victim (or multiple victims) and the gateway they want to impersonate.
2. They send spoofed ARP replies. Instead of waiting for an ARP request, the attacker sends unsolicited ARP replies — these are called gratuitous ARP packets. They say things like: "Hey everyone, I'm 192.168.1.1, and my MAC is aa:bb:cc:dd:ee:ff."
3. Victims update their ARP caches. Every device on the network hears this and thinks, "Oh, the router's MAC changed." They update their local ARP table and start sending traffic to the attacker.
4. The attacker forwards traffic. To avoid breaking connectivity (which would tip off the victim), the attacker forwards the traffic to the real gateway. This is what makes it a man-in-the-middle attack — the victim doesn't notice anything's wrong.
5. The attacker sniffs or modifies traffic. Now they can capture passwords, session cookies, or inject malicious content into web pages.

What a Gratuitous ARP Packet Looks Like

A gratuitous ARP is an ARP reply where the sender and target IP addresses are the same. On top of that, it's the attacker essentially shouting to the network: *"I am 192. 168.1.Day to day, 1. Send me your traffic Small thing, real impact..

In Wireshark, you'll see something like this:

Sender IP: 192.168.1.1
Target IP: 192.168.1.1
Sender MAC: aa:bb:cc:dd:ee:ff (the attacker)
Target MAC: aa:bb:cc:dd:ee:ff

The fact that the sender and target IP are identical is the first red flag.

How to Detect ARP Spoofing with Wireshark

Here's where it gets practical. That's why you don't need expensive tools or deep networking knowledge. Wireshark is free, and the detection process is straightforward.

Step 1: Start Capturing

Open Wireshark and start capturing on your active network interface. On Windows, this is usually your Ethernet or Wi-Fi adapter. On Linux, it's often eth0 or wlan0 Worth knowing..

Step 2: Filter for ARP Traffic

In the Wireshark display filter bar, type arp and press Enter. This filters out everything except ARP packets, making it much easier to spot anomalies Took long enough..

Step 3: Look for Red Flags

Here are the specific things to watch for:

Multiple ARP replies from the same IP with different MAC addresses. This is the classic sign of ARP spoofing. If you see 192.168.1.1 claiming to have MAC aa:bb:cc:dd:ee:ff and then five seconds later claiming to have MAC 11:22:33:44:55:66, someone is spoofing.

Gratuitous ARP packets. Remember, these are ARP replies where sender IP equals target IP. They're not inherently malicious — devices send them during normal operations like IP conflicts or DHCP assignments. But if you see a flood of them from an unfamiliar MAC address, that's suspicious.

Rapid ARP flooding. If your screen fills with hundreds of ARP packets per second, especially from a single source, that's likely an attack.

Step 4: Use Wireshark's Built-in Tools

Wireshark has a feature that makes this even easier. And go to Statistics > Endeavor > ARP (the exact path varies by version). This gives you a table showing every IP-to-MAC mapping seen during the capture, along with how many times each was observed Most people skip this — try not to..

If you see the same IP mapped to multiple MAC addresses, you've found your smoking gun.

Step 5: Confirm with a Second Capture

To be thorough, run a second capture a few minutes later. If the same anomalies appear, you're almost certainly dealing with an active ARP spoofing attack.

Common Mistakes People Make When Analyzing ARP Traffic

I've reviewed dozens of Wireshark captures from users trying to detect ARP spoofing, and certain mistakes keep popping up. Here's what most people get wrong.

Mistake #1: Panicking Over Normal ARP Traffic

Not every unusual ARP packet is malicious. Devices legitimately send gratuitous ARP packets when they come online, change IP addresses, or detect IP conflicts. A single gratuitous ARP from a device that just connected to the network is normal Most people skip this — try not to..

The key is frequency and persistence. Consider this: one packet? Worth adding: probably fine. Dozens per second from the same MAC? That's your problem Easy to understand, harder to ignore..

Mistake #2: Ignoring the MAC Address

People focus on the IP addresses and completely overlook the MAC addresses. Day to day, the MAC address tells you which physical device is sending the packets. If you see a flood of spoofed ARP replies coming from a MAC address you don't recognize, that's your attacker Most people skip this — try not to..

You can look

up the MAC address against your router's DHCP client list or physical inventory to identify the culprit Took long enough..

Mistake #3: Not Understanding ARP Packet Structure

Many users don't realize that Wireshark displays two separate sections for ARP packets: the "Address Resolution Protocol (request)" and "Address Resolution Protocol (reply)" sections. A request packet shows "Who has 192.168.Think about it: 1. 1? Now, tell 192. 168.1.Now, 100," while a reply shows "192. 168.1.Worth adding: 1 is at aa:bb:cc:dd:ee:ff. " Both are important to monitor The details matter here..

Request packets flood is often less concerning than reply floods, which indicate active poisoning attempts.

Mistake #4: Stopping at Single Observations

Network security isn't about single events—it's about patterns. One or two anomalous ARP packets might be legitimate network events. But persistent patterns over time reveal the attack Simple as that..

Always capture for several minutes and look for recurring issues.

Mistake #5: Confusing ARP Poisoning with Normal Network Churn

In busy networks with frequent device connections and disconnections, you'll naturally see ARP tables updating. Don't assume every IP-MAC mismatch is malicious That's the part that actually makes a difference. Worth knowing..

Look for consistency in the anomalies. If the same IP consistently claims different MACs across multiple captures, that's your attack vector That's the part that actually makes a difference..

What to Do When You Find ARP Spoofing

Once you've confirmed ARP spoofing, act quickly but methodically Most people skip this — try not to..

Immediate Actions

1. Isolate the attacker: Identify the MAC address responsible and physically disconnect that device from the network.
2. Clear ARP caches: On Windows, run arp -d * in Command Prompt as Administrator. On Linux, use ip neigh flush all. On macOS, restart the network interface.
3. Restart network infrastructure: Power cycle your router and any managed switches to clear their ARP tables.

Long-Term Solutions

Enable Dynamic ARP Inspection (DAI) if your switch supports it. This feature validates ARP packets against a trusted database of IP-MAC bindings Nothing fancy..

Use static ARP entries for critical devices like servers and network infrastructure. While not a complete solution, it prevents attackers from poisoning these key targets Practical, not theoretical..

Implement port security on managed switches to limit which MAC addresses can connect to each switch port Worth keeping that in mind..

Deploy network monitoring tools that alert on ARP anomalies rather than relying on manual packet analysis Small thing, real impact. Turns out it matters..

Final Thoughts

ARP spoofing remains one of the most common and effective network attacks precisely because it's so simple to execute and difficult to detect without proper tools and knowledge. The attack exploits a fundamental trust relationship in how networks operate, allowing attackers to intercept traffic, steal credentials, and pivot to other systems Which is the point..

Wireshark provides the visibility needed to detect these attacks, but only if you know what to look for and understand what constitutes normal versus abnormal behavior. The key is recognizing patterns rather than isolated events, and understanding that network security requires constant vigilance.

Don't let ARP spoofing catch you off guard. Regular network monitoring, combined with proper infrastructure hardening, creates multiple layers of defense that make these attacks much harder to execute successfully. Remember: the goal isn't just to detect ARP spoofing after it happens, but to make it so difficult that attackers move on to easier targets Practical, not theoretical..

Stay vigilant, stay secure.