I know how arp poisoning works in the LAN environment and I know that routers also contains mac-address tables with the neighbouring router's mac-addresses, that means routers exchange arp frames. So is there any possibility to send the arp poisoning attack to ISP level? Till now is there any attacking techniques exists regarding arp poisoning in WAN. If not how the attackers are doing man-in-the-middle attacks & what is the security mechanism the routers use to stop these attacks?

2 Answers 2


Based on your question, I don't think you understand ARP poisoning as well as you think you do.

In most cases, WAN links are point to point, so there's nowhere to redirect traffic to.

If you're not within the layer 2 broadcast domain, you won't be able to send or receive ARP messages, legitimate or otherwise.

  • Could you please elaborate
    – ashok
    Oct 19, 2015 at 14:54
  • Which part are you having trouble with?
    – Ron Trunk
    Oct 19, 2015 at 14:55
  • WAN links are point to point and can't we send the arp packets using direct broadcast address?
    – ashok
    Oct 19, 2015 at 14:56
  • 3
    By point to point (DSL, T1, FiOS, dial up, etc), I mean there are only two devices on the segment -- you and your ISP. Where would you redirect traffic to? For ARP poisoning to work, you need a third device, the attacker, to be on the same broadcast domain.
    – Ron Trunk
    Oct 19, 2015 at 15:02
  • 1
    Following the same logic, there are only two devices on the network, so it stands to reason you have to compromise one or the other. Or, you have to physically insert yourself into the network.
    – Ron Trunk
    Oct 19, 2015 at 15:22

If the WAN is a shared ethernet, maybe. That tends to only happen in cheap/lazy data centers. Common (residential) WAN protocols like DSL and DOCSIS are point-to-point; while they may be ethernet and appear to be a shared medium, all traffic flows through the ISP headend (DSLAM/CMTS), CPE's cannot directly communicate.

Beyond that, ISP technology intended to be used in such a manor has various security mechanisms to prevent this sort of thing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.