6.5 Man-in-the-Middle and Network Attack Basics
Why ARP Trusts Strangers
On every Ethernet network, a host must resolve an IP to a MAC address before it can send a frame, and it does so with ARP -- a protocol that is stateless and gullible: it accepts unsolicited replies. An attacker on the LAN simply broadcasts "192.168.1.1 is at MAC aa:bb:cc..." and the victim's ARP cache happily overwrites the real gateway. Now the victim's traffic is addressed to the attacker's machine. The attacker enables IP forwarding and relays every packet onward to the true gateway, so connections stay alive and both endpoints see a healthy network -- an on-path position with zero visible outage.
Switches, DNS, and Local Domains
Switches were supposed to end sniffing by learning per-port MAC tables, and they do -- but ARP spoofing defeats the premise, because the victim voluntarily sends its frames to the attacker's port. From there the attacker upgrades to content attacks: DNS spoofing answers lookups with attacker IPs microseconds faster than the real server, so any domain on the subnet -- even one never registered -- resolves to a hostile login page. This local domain hijacking turns every captive-portal-style intercept into a credential funnel. The real fixes live on the switch: Dynamic ARP Inspection validated against a DHCP snooping binding table, plus port security and 802.1X.
Rogue APs and the Evil Twin
The wireless variant needs no ARP at first: the attacker broadcasts your office SSID from a pocket device with a stronger signal, and phones auto-roam to the "better" twin. An open twin with a fake captive portal harvests credentials directly; an encrypted one just needs to pass traffic while the operator sniffs whatever is not end-to-end encrypted. WPA2-personal derives one pairwise master key from the shared passphrase, so anyone who knows it can decrypt other clients' frames; WPA3 and 802.1X enterprise give every client its own keys.
Staying Off-Path
Layer-3 interception only pays if the content is readable, so the durable defense is TLS everywhere with HSTS preload: an on-path attacker without a trusted certificate produces a hard browser error and a dead phishing page. Add a pinned VPN on untrusted networks, disable auto-join, verify known BSSIDs, and treat any network you did not configure as hostile territory.
Architecture Diagram
Key Takeaways
- ARP accepts unsolicited replies by design, so one broadcast frame can make the attacker the gateway.
- On-path malware forwards traffic onward, so connections stay up and nothing looks broken to the victim.
- DNS spoofing from the on-path position hijacks any local lookup, turning captive portals into credential funnels.
- Evil twins exploit auto-join and signal strength; WPA3/enterprise per-client keys blunt shared-key sniffing.
- TLS with HSTS, 802.1X, DAI, and a pinned VPN make interception positionally possible but payload-useless.