The Address Resolution Protocol (ARP) has a fundamental design characteristic that makes it vulnerable: it is stateless. This means ARP doesn't keep a record of the requests it sends out. When a device receives an ARP reply, it has no way to verify if it ever sent a corresponding request. It simply accepts the information and updates its ARP cache, which is the local map of IP addresses to physical MAC addresses.

This behavior operates on a principle called Trust on First Use (TOFU). The network device assumes the first MAC address it learns for a given IP address is correct. This is efficient for a busy local network, as it avoids complex verification steps for every communication. However, this efficiency comes at the cost of security. An attacker can exploit this trust by sending a crafted ARP reply to a target machine, even if that machine never asked for one. The target device will blindly accept the fraudulent information and update its cache accordingly.

The mechanism for this attack is a special type of ARP message called a gratuitous ARP (GARP). A gratuitous ARP is an ARP reply that was not prompted by an ARP request. Legitimate uses for GARP include a device announcing its presence on the network after changing its IP address or coming online. It's like a new neighbor moving in and proactively telling everyone on the street their new address.

An attacker abuses this feature by sending forged gratuitous ARP packets to a victim and the network gateway (like a router). The goal is to poison their ARP caches. The attacker sends a GARP reply to the victim, falsely associating the gateway's IP address with the attacker's own MAC address. Simultaneously, they send another GARP reply to the gateway, associating the victim's IP address with the attacker's MAC address.

Once both caches are poisoned, all traffic between the victim and the gateway is routed through the attacker's machine. The victim thinks it's sending packets directly to the gateway, and the gateway thinks it's receiving them directly from the victim. In reality, the attacker is in the middle, able to intercept, read, or even alter all the communication. This establishes a Man-in-the-Middle (MITM) position at Layer 2 of the network.

Creating a forged ARP reply involves carefully crafting specific fields within the packet. The attacker doesn't need to invent a new packet structure; they just fill the standard ARP reply fields with deceptive information. Let's look at the key fields and how they are manipulated in an attack targeting a victim computer and a gateway router.

In the packet sent to the victim, the Sender IP field contains the gateway's IP, but the Sender MAC field contains the attacker's MAC. The victim's ARP cache is updated, linking the gateway's IP to the attacker. Conversely, in the packet sent to the gateway, the Sender IP is the victim's, but the Sender MAC is again the attacker's. Now the gateway's ARP cache is also poisoned. The Opcode of '2' signifies that the packet is a reply, ensuring the receiving device processes it as an update to its cache without question.

By understanding these mechanics, you can see how easily an attacker on a local network can intercept traffic. This fundamental vulnerability is why network monitoring and security tools are designed to detect suspicious ARP activity, such as multiple ARP replies for the same IP address with different MAC addresses.