A man-in-the-middle (MITM) attack secretly intercepts communications between two parties and relays the messages. The attacker can read the exchanged contents and alter them without either party noticing. section 11.2.1 section 11.6
A typical ARP-poisoning MITM attack proceeds as follows:
- PC1 broadcasts an ARP request to learn R1’s MAC address, and R1 replies; both hosts learn each other’s legitimate address. section 11.2.1
- The attacker sends malicious ARP replies to PC1 and R1, mapping both IP addresses to the attacker’s MAC address. section 11.2.1
- PC1 and R1 then send frames to the attacker instead of directly to each other, enabling interception and possible alteration. section 11.2.1
ARP poisoning between PC1 and R1
An attacker poisons the ARP tables of PC1 and R1 so that each host associates the other’s IP address with the attacker’s MAC address. The attacker can consequently relay their frames while accessing or modifying the communication. section 11.2.1
