As a cybersecurity professional, you may be asked to help an organization identify any ARP poisoning attacks on their network infrastructure.
ARP poisoning is the process in which an attacker sends fake ARP messages to a victim's machine to create the effect of modifying the entries in the victim's ARP cache. This would cause the victim's machines to send frames (traffic) to a rogue device on the network rather than the legitimate destination.
To explain the detection process of ARP poisoning, we'll use the following topology:
Using Wireshark, we can look for specific patterns of traffic between endpoint devices on the network. Using the arp filter on Wireshark, we will only be able to view ARP messages, as shown in the following screenshot:
Within the Info column, a few of the packets have unusual descriptions. By expanding...