ARP Spoofing

What is ARP Spoofing?

ARP spoofing, also called ARP poisoning or ARP cache poisoning, is a local network attack in which an attacker sends forged ARP messages so that other devices map the IP address of a legitimate system to the attacker’s MAC address. Traffic meant for that system then flows through the attacker, who can read, alter, delay or block it. The terms are used interchangeably: “spoofing” describes faking the identity, “poisoning” describes the result, a corrupted ARP cache. In OT networks this is a classic stepping stone to a Man-In-The-Middle attack between a PLC and a SCADA system.

ARP spoofing only works inside a single broadcast domain, but there it is almost always possible: the protocol has no form of authentication at all.

🧠 How does ARP work and why is it vulnerable?

The Address Resolution Protocol was defined in RFC 826 in 1982. A device that wants to send an IPv4 packet to a neighbour on the same VLAN needs to know that neighbour’s MAC address. The exchange works like this:

• ARP request - the device asks via broadcast: “Who has 192.168.10.20?”
• ARP reply - the owner answers directly with its MAC address
• ARP cache - the sender stores the mapping for a while, so that not every packet needs a new question

The design is based on trust. A reply is not checked for authenticity, many operating systems also accept replies they never asked for, and a newer reply overwrites an older one. Gratuitous ARP, a message in which a device announces its own address (used among other things for address conflict detection under RFC 5227), adds no authentication either. These properties are exactly what makes ARP poisoning possible.

🎯 How does an ARP spoofing attack unfold step by step?

1. Access to the segment - the attacker controls a device in the same broadcast domain: a compromised engineering workstation, a rogue laptop on a spare switch port or an infected HMI.
2. Reconnaissance - by listening passively or running an ARP scan, the attacker maps which IP addresses belong to which PLCs, HMIs and servers.
3. Poisoning in both directions - the attacker tells the SCADA server “the PLC’s IP belongs to my MAC” and tells the PLC “the SCADA server’s IP belongs to my MAC”. Because cache entries expire, the attacker repeats these messages every few seconds.
4. Forwarding - the attacker enables IP forwarding, so the connection keeps working and nobody notices.
5. Abuse - traffic is eavesdropped, modified, replayed as a replay attack or simply dropped.

MITRE ATT&CK for ICS describes this under technique T0830 (Adversary-in-the-Middle) and names ARP poisoning as one of the most common methods. The IT variant appears in the Enterprise matrix as T1557.002 (ARP Cache Poisoning).

⚠️ What are the consequences in OT environments?

Many industrial protocols, such as Modbus TCP, have no integrity check or authentication. Whoever sits in the middle can therefore change values without being noticed.

MITRE lists follow-on actions including blocking or spoofing reporting messages, modifying parameters and sending unauthorised command messages. These directly affect the integrity and availability of the process.

An important detail: protocols that run directly on Layer 2 of Ethernet, such as GOOSE from IEC 61850 and the real-time traffic of ProfiNET, do not use ARP to deliver frames. ARP spoofing targets IP-based traffic: Modbus TCP, EtherNet/IP, OPC UA, S7 communication, HMI clients and historians.

🔍 How do you detect ARP poisoning?

In OT, passive detection is the safest approach. A sensor on a SPAN port (Passive Monitoring) sees ARP anomalies without sending any traffic to sensitive controllers itself. A good asset inventory makes all the difference: only when you know which MAC address belongs to which PLC does a deviation stand out.

🛡️ Which controls protect against ARP spoofing?

On Cisco switches, DAI limits ARP traffic on untrusted ports to 15 packets per second by default; when that is exceeded, the port goes into err-disable. Test this first, because some devices send bursts of ARP traffic at start-up. Following the principle of Zero Trust, you should also assume that internal traffic is not automatically trustworthy.

🔧 How do you approach ARP security in practice?

1. Inventory all IP-MAC mappings per OT segment and record them.
2. Shrink broadcast domains, so that an infected laptop can only reach a handful of devices.
3. Disable unused switch ports and enable port security on the rest.
4. Enable DAI on managed switches; use ARP ACLs for statically addressed PLCs and mark uplinks as trusted.
5. Set static ARP entries on critical HMIs and SCADA servers where administration allows it.
6. Monitor passively with an OT IDS and forward alerts to the SIEM.
7. Test in a lab with tools such as arpspoof, ettercap or bettercap and check that detection and blocking work. Never run such tests on a production network.

IEC 62443-3-3 requires protection against manipulation of transmitted messages in its communication integrity requirement (SR 3.1). Layer 2 controls against ARP poisoning contribute to meeting it, but MITRE also points out that message authentication (mitigation M0802) makes tampered messages visible even if an attacker does get into the middle.

❓ Frequently asked questions

What is the difference between ARP spoofing and ARP poisoning?

ARP spoofing and ARP poisoning describe the same attack. Spoofing refers to faking the identity in the ARP message, poisoning to the result: an ARP cache holding a false IP-MAC mapping. The term ARP cache poisoning means the same thing.

Can ARP spoofing work over the internet or across a router?

No, ARP spoofing only works within one broadcast domain, so within the same VLAN or subnet. An attacker must therefore first control a device in that segment. That makes ARP spoofing a typical step after initial intrusion, during lateral movement or in an insider threat scenario.

Does ARP spoofing also affect IPv6?

IPv6 does not use ARP but Neighbor Discovery (NDP), which has a comparable weakness. The IPv6 counterpart of ARP spoofing is called neighbour spoofing; switches counter it with features such as ND Inspection, while RA Guard blocks rogue router advertisements. In most OT networks, IPv4 with ARP still plays the leading role.

Does a firewall protect against ARP spoofing?

A firewall between zones does not stop ARP spoofing inside a zone, because ARP traffic never passes through the firewall. A firewall with small zones does limit the number of devices an attacker can reach via ARP. Real protection comes from switch features such as DAI and port security.

How do you check whether your ARP cache has been poisoned?

Inspect the ARP cache with arp -a (Windows) or ip neigh (Linux) and look for several IP addresses sharing one MAC address, especially for the gateway or a PLC. Compare the MAC address with the known value from your asset inventory. For continuous coverage, arpwatch or an OT IDS works better than manual checks for ARP poisoning.

Why is ARP spoofing more dangerous in OT than in IT?

ARP spoofing is more dangerous in OT because many industrial protocols lack encryption and authentication, and a manipulated value directly drives a physical process. OT networks are also often flat, with legacy equipment that supports neither 802.1X nor encryption. An attacker can thus show the operator a false picture of the process.

📌 In summary

ARP spoofing, also known as ARP poisoning, exploits the lack of authentication in ARP to route traffic between PLCs, HMIs and SCADA servers through an attacker. Prevent it with small segments, Dynamic ARP Inspection, port security and static mappings for critical systems, and detect it with passive monitoring against a known asset baseline.