ARP and Layer 2 Fundamentals

An IP address gets a packet across networks; it doesn't get a frame across the last few feet of cable. On the local segment, switches forward traffic by MAC address — the hardware address burned into every network interface — not by IP. So before a host can actually deliver anything to 10.1.1.1, it needs to know: which MAC address on this wire answers to that IP?

That's the gap ARP (Address Resolution Protocol) closes. The sending host broadcasts an ARP request — “who has 10.1.1.1? tell 10.1.1.20” — to every device on the segment. The owner of that IP replies directly with its MAC address, and the sender caches the mapping in its ARP table for a few minutes so it doesn't have to broadcast again for every packet. Open the ARP cache on any laptop and you're looking at a live map of who the machine believes its neighbors are.

The problem is trust. ARP has no authentication built in — nothing requires a reply to be honest, and a host doesn't even need to be asked first. A device can send an unsolicited gratuitous ARP reply claiming any IP address it wants, and neighboring hosts will simply overwrite their cache with the lie. That single design gap is the entire basis of ARP poisoning (also called ARP spoofing): an attacker on the same segment sends forged replies to a victim and to the default gateway, each claiming to own the other's IP. Both sides update their ARP tables to point at the attacker's MAC address instead, and every packet between them now routes through the attacker first — a textbook on-path (man-in-the-middle) position, used to eavesdrop, hijack sessions, or strip TLS before traffic is quietly forwarded on so nothing looks broken.

Because the attack lives in the cache rather than in any payload, detection is a matter of watching how the mappings behave. Three signals are worth alerting on:

• An ARP reply arrives with no matching request, or the reply rate from one host spikes across many IPs — a single machine trying to poison the whole segment.
• The same IP resolves to two different MAC addresses within a short window, or the gateway's MAC changes without a known hardware swap.
• A workstation suddenly shows up as the MAC address for a server or the default gateway in another host's ARP cache.

Defenses work because ARP poisoning is a local-segment attack: it can't cross a router. Dynamic ARP Inspection on managed switches validates ARP packets against a trusted DHCP snooping table and drops forged ones at the port; static ARP entries pin the mapping for gateways and other high-value hosts so no reply can override them; and tighter VLAN segmentation shrinks the broadcast domain, which shrinks how much traffic any one poisoned segment can expose.

ARP poisoning never touches an IP header or a signature an antivirus engine would recognize — it's a lie told entirely at Layer 2. Catching it means knowing what the segment's MAC-to-IP mappings normally look like and flagging the moment they don't. That's the baseline Vijilan's SOC analysts watch for on every managed endpoint, whether they're monitoring a partner's existing EDR under ThreatRespond™ or running the fully managed CrowdStrike Falcon stack under ThreatDefend™.