3

enter image description here

Hello, I'm studying link layer and ARP Spoofing. While I was searching ARP Spoofing on internet, I found that being attacked by ARP spoofing can be found by checking whether there are duplicate entries that have same MAC address, but different IP address in ARP table.

However, I can't understand why those duplicate entires mean being attacked by ARP Spoofing. As far as I know, ARP Spoofing means that attacker sends an ARP respond that "I am the gateway!". Therefore, a tuple of (Gateway IP address, Attacker's MAC address) will be in the ARP table. But what is the another one? I don't know why there are two duplicate tuples at all.

2

As far as I know, ARP Spoofing means that attacker sends an ARP respond that "I am the gateway!."

That is only true if the attacker is trying to spoof the gateway MAC address. At its core, ARP spoofing is responding to an ARP request with a spoofed reply pointing to an incorrect MAC address, and it could be for any IPv4 address, not only the gateway address.

The spoofing can be tricky because the real host will also respond to the ARP request. The ARP request is a broadcast so that all the hosts on the LAN get it, and both hosts claiming the IP address will respond with a MAC address for that IP address. The first ARP reply received will be entered into the ARP table, and if all hosts are on the same switch, or the responding hosts are on different switches than the sending host, you cannot predict which one will be received by the requesting host first.

In the meantime, the requesting host will receive an ARP reply from the other host, and it is supposed to update its ARP cache and use that MAC address for traffic sent to that IP address.

ARP table entries also time out, necessitating more ARP requests at a later time.


Duplicate MAC addresses in an ARP table could be for several legitimate reasons. In your example, the local interface is on a different IPv4 (layer-3) network than the ARP table entries. Those entries should be pointing to the gateway MAC addresses (layer-2) necessary to reach those addresses on the other networks. You can have multiple gateways on a LAN, and different foreign networks or addresses can use different gateways to reach the different networks/addresses. Probably, all the addresses in a single foreign LAN should resolve to the same gateway MAC address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.