ARP SPOOFING (or ARP poisoning) lets an attacker on a LAN

1. ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network. It has NO authentication. 2. ARP SPOOFING: attacker sends forged ARP replies claiming to be the gateway (or another host). 3. Other hosts update their ARP tables; traffic destined for the gateway now flows to the attacker — enabling MITM. 4. MITIGATIONS: • DYNAMIC ARP INSPECTION on managed switches (compares ARP packets against DHCP snooping table). • Static ARP entries for critical hosts (rare in modern networks). • PORT SECURITY on switches limits MAC addresses per port. 5. Tools: Ettercap, arpspoof — used by pen-testers to demonstrate the attack. _Source: NIST SP 800-12 + RFC 826 (ARP) — vulnerability is well-known in the protocol design._