ARP Spoofing

Definition

ARP spoofing is a technique by which a device already present on a local network impersonates the gateway — the router or box — to the other devices, so that their traffic passes through it. It requires prior access to the network, which sets it apart from a fake access point, where the third party supplies the network itself.

How it works

On a local network, devices work out among themselves who holds which address through an exchange of questions and answers designed at a time when participants were assumed to be honest. This mechanism includes no identity check: a reply claiming 'I am the gateway' is accepted as such. A malicious device already present on the network can therefore place itself on the path without forcing anything, simply by answering. The consequences are those of any interception, with two particularities. The first is scope: this only works on the local network, so it requires the attacker to already be on it — a guest, a compromised device in the household, a neighboring workstation in a shared space. The second is invisibility: nothing changes from the user's point of view, there's no network to choose, no page to accept, no suspicious name. This is why the protection can't be behavioral: it consists of not leaving unknown devices on your network, and not relying on the network for confidentiality.

Warning signs

• Unknown devices in the list of equipment connected to your router
• Repeated certificate warnings on one given network, and that one alone
• Recurring slowdowns or drops affecting several devices on the same network
• On a shared network — shared housing, workspace, hotel — you have no way of knowing who is present
• No visible sign at all, which is the ordinary case

How to verify

The check within your reach concerns the network's makeup, not the attack itself: open your router's admin interface and identify every connected device. Whatever can't be explained should be removed. On a shared network you don't manage, treat the question as undecidable and act accordingly.

What to do

Don't leave unknown devices on your network: use a strong Wi-Fi password, and set up a separate guest network for visitors and connected objects. On a network you don't manage, don't rely on the network for confidentiality — encrypted connections and, if needed, a VPN do the work the local network can't.

If it already happened

Remove the unidentified device from the network and change both the Wi-Fi password and the router's admin password, which is often still at its factory default. From another network, change the passwords of the services used and close open sessions. If the intruding device belongs to the household, it is itself compromised: treat it as such before reconnecting it. Report the incident to the relevant authority.

Frequently asked questions

Am I at risk at home?

Only if an unwanted device is present on your network — an intruder connected to the Wi-Fi, or a household device already compromised. That's why the useful protection happens upstream: a strong Wi-Fi password and a separate guest network for connected objects.

Can I detect it myself?

Not reliably without technical tooling, and that's not the right angle anyway. The question within your reach is simpler and more useful: who is connected to my network? If you can answer that one, the attack has no starting point.

Related attacks

• Man-in-the-Middle Attack
• DNS Poisoning
• Network Traffic Interception
• Compromised router or gateway
• Botnet

Official sources

• Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)