Address Resolution Protocol (ARP) acts like a local directory for a network. When a device wants to send data to an IP address on its local network, it shouts, "Who has this IP address?" The device with that IP replies with its unique MAC address. This IP-to-MAC mapping is then stored in an ARP cache on the first device for quick reference.

ARP cache poisoning exploits this trust-based system. An attacker doesn't wait to be asked. Instead, they proactively send a forged ARP reply to a target computer. This special type of unsolicited reply is called a Gratuitous ARP packet.

This malicious packet tells the victim's computer that the gateway router's IP address now maps to the attacker's MAC address. Simultaneously, the attacker sends another gratuitous ARP packet to the router, claiming the victim's IP address maps to the attacker's MAC. The result? Both the victim and the router update their ARP tables with the attacker's MAC address, placing the attacker squarely in the middle of their conversation.

Simply intercepting traffic isn't enough. If the victim's internet connection breaks, they'll quickly become suspicious. To avoid detection, the attacker must forward the captured packets between the victim and the router. This creates a seamless man-in-the-middle position where all traffic flows through the attacker's machine without interrupting the victim's service.

On a Linux-based system, this is achieved by enabling IP forwarding. This setting tells the operating system's kernel that it's allowed to route packets that aren't destined for it.

This simple command turns the attacker's computer into a temporary router, silently passing traffic along after inspecting or modifying it. Meanwhile, the network's switch is also being deceived. A switch uses a CAM table to map MAC addresses to physical switch ports. By sending packets with a spoofed source MAC address, the attacker poisons the switch's CAM table, tricking it into sending the victim's traffic to the port connected to the attacker's machine.

Manually crafting and sending these packets is tedious. Fortunately, powerful tools automate the process. Suites like Ettercap and its more modern successor, Bettercap, are designed specifically for man-in-the-middle attacks. They can scan the local network, identify potential targets, and execute the ARP poisoning attack with just a few commands. These tools handle the continuous sending of malicious ARP packets to keep the cache poisoned and manage the forwarding of traffic automatically, allowing an attacker to focus on analyzing the intercepted data.

With the ARP cache poisoned and traffic flowing through the attacker's device, the Layer 2 redirection is complete. Now, let's test your understanding of how this attack is executed.