AP® Cybersecurity glossary
ARP poisoning
Also called: ARP spoofing
Sending falsified address resolution protocol (ARP) packets so a device's ARP table pairs the target's internet protocol (IP) address with the adversary's media access control (MAC) address.
Appears in the course and exam description (CED): 3.1.A.13.5.E.3
Why it matters in Unit 3
Traffic meant for the target goes to the adversary first: an on-path attack. Detect it by looking for one MAC address listed for two IP addresses.
Example
The default gateway’s ARP table shows 192.168.1.10 and 192.168.1.66 with the same MAC address. The adversary at .66 is now on the path.
Learn it properly, with a checkpoint Addresses: MAC, IP, ARP, DNS and ICMP