Network Analysis Using Wireshark 2 Cookbook - Second Edition

ARP poisoning and man-in-the-middle attacks

One of type of man-in-the-middle attack is when an attacker poisons the ARP cache of the devices that they want to listen to with the MAC address of their Ethernet NIC. Once the ARP cache has been successfully poisoned, each of the victim devices sends all their packets to the attacker while communicating with the other device. The attacker, of course, will resend it to them after reading the data.

This is called a man-in-the-middle attack since it puts the attacker in the middle of the communication path between the victim devices. It is also called ARP poisoning since the attacker actually poisons the victim's ARP cache with wrong information.

In the following diagram, we see an example of a man-in-the-middle ...