# ARP Spoofing & Poisoning

The Address Resolution Protocol (ARP) is fundamentally insecure by design because it is a "stateless" and "trusting" protocol. It was built in the early days of networking when everyone on a local network trusted each other.

## How Normal ARP Works
As a reminder, ARP operates at Layer 2 (Data Link). When your computer (IP: `10.0.0.5`) wants to send a packet to the internet, it must first send it to your Default Gateway (the Router, IP: `10.0.0.1`). However, switches don't understand IP addresses; they only understand physical MAC addresses.

1.  Your computer shouts out to the entire network: *"Who has IP 10.0.0.1? Tell 10.0.0.5."*
2.  The Router (`10.0.0.1`) replies directly to your computer: *"I am 10.0.0.1, and my MAC address is AA:BB:CC:DD:EE:FF."*
3.  Your computer saves this mapping in its temporary **ARP Cache**.

## The Attack: ARP Spoofing
The flaw in ARP is that an attacker can send out an **ARP Reply** *even if no one asked for it* (this is called a Gratuitous ARP). Furthermore, devices will gladly accept this unsolicited reply and update their ARP cache without any verification.

**The Scenario:**
Let's say the Hacker's MAC address is `66:66:66:66:66:66`.

1.  The attacker sends a forged ARP Reply to the Victim (`10.0.0.5`) saying: *"Hey, the Router (10.0.0.1) is now at MAC 66:66:66:66:66:66."*
2.  The Victim's computer blindly trusts this and updates its ARP cache.
3.  The attacker also sends a forged ARP Reply to the true Router (`10.0.0.1`) saying: *"Hey, the Victim (10.0.0.5) is now at MAC 66:66:66:66:66:66."*
4.  The Router blindly trusts this and updates its ARP cache.

## The Result: Man-in-the-Middle (MITM)
Because the attacker has "poisoned" the ARP cache of both the Victim and the Router, all traffic flowing between them now routes directly through the attacker's machine. 

The attacker can now:
*   **Packet Sniff:** Read unencrypted traffic (HTTP, FTP, Telnet) in real-time, stealing passwords and session cookies.
*   **Packet Modify:** Alter the traffic in transit (e.g., replacing a legitimate software download with a malware payload).
*   **Denial of Service (DoS):** Simply drop all the packets from the victim, disconnecting them from the internet (a "Blackhole" attack).

*Note: ARP Spoofing only works on the LOCAL network (LAN). An attacker in Russia cannot ARP Spoof a victim in New York, because MAC addresses do not cross routers.*