Man-in-the-Middle (MiTM) Attack

MiTM attacks are probably the most common, and potentially most dangerous, goal of ARP poisoning. The attacker sends out falsified ARP responses for a given IP Address, typically the default gateway for a particular subnet. This causes victim machines to populate their ARP cache with the MAC address of the attacker’s machine, instead of the local router’s MAC address. Victim machines will then incorrectly forward network traffic to the attacker. Tools like Ettercap allow the attacker to act as a proxy, viewing or modifying information before sending the traffic to its intended destination. To the victim, everything may appear normal.

Marrying ARP Poisoning with DNS Poisoning can dramatically increase the effectiveness of a MiTM attack. In this scenario, a victim user might type in a legitimate site such as google.com and be given the IP address of the attacker’s machine, rather than the rightful address.