Detecting ARP spoofing

- [Voiceover] Address resolution protocol is used to…resolve an IP address to a physical address.…Now ARP can have some problems, they're rare but…mainly they're due to configuration errors and that…someone may have assigned an incorrect IP address…or there may be an incorrect subnet mask.…However, we know that there are attacks against…ARP, one being ARP spoof attack.…ARP spoofing in used in a man-in-the-middle attack.…It's also known as an ARP cache poison.…

This attacker sends spoofed ARP messages.…Now, you ask yourself how does this happen?…ARP spoofing can take place because ARP is stateless,…meaning it doesn't retain any prior information…on packets that it had sent in the past.…An ARP reply can be sent even if there…has been no request and it will be accepted.…This then poisons the cache.…Well let's take a look.…I'm at this website securitysite.com and here…we see some PCap file analysis.…

This page is loaded with a lot of PCaps that you can…used in order to study a little bit more about the protocols…but I'm going to take a look at ARP spoof.…