STUDYING THE ARP SPOOFING ATTACK USING SWITCHES FROM DIFFERENT VENDORS AS EXAMPLES
Abstract
This paper examines the susceptibility of a switched local network to ARP spoofing and describes a laboratory ARP-spoofing scenario using Cisco Catalyst 2960, Eltex MES1428, and MikroTik CRS326-24G-2S+RM switches. The topology included two Windows victim hosts and an attacking host running Kali Linux. Ettercap was used to conduct the attack, while Wireshark was used to analyze network traffic; ARP tables and ICMP ping were used to record changes. In the described scenario, the attacker sent forged ARP replies associating its MAC address with the addresses of the gateway and target host. The capture shows requests and responses between the hosts, but does not establish their full path through the attacking machine; ARP tables before and after the attack showed a changed IP-to-MAC mapping. The paper also describes protection configurations for Cisco and Eltex using DHCP Snooping and Dynamic ARP Inspection, and static ARP entries for MikroTik. The observations record an ARP mapping change in this example and illustrate ARP-table and packet analysis in network-security training. It does not constitute an exhaustive test of every model, firmware version, or configuration from the named vendors. Conclusions about default configurations therefore apply only to the described testbed; other configurations require separate testing. The procedure distinguishes the authors’ attack description from observed ARP records and frames; these fragments do not establish a complete MITM chain. The manuscript describes protection settings but provides no documented post-protection attack trial, so their effectiveness is not established by the reported results.
Online viewer
References
- Conti, M., Dragoni, N., & Lesyk, V. (2016). A survey of man in the middle attacks. IEEE Communications Surveys & Tutorials, 18(3), 2027–2051.
- Krylov, A. Yu., Shitov, N. A., & Galiasgarov, E. G. (2010). Primenenie obektnogo podkhoda pri sozdanii raspredelennoi sistemy vyyavleniya i predotvrashcheniya ataki tipa ARP-spoofing [Application of the object-oriented approach in creating a distributed system for detecting and preventing ARP-spoofing attacks]. Obektnye sistemy, 2(2). https://cyberleninka.ru/article/n/primenenie-obektnogo-podhoda-pri-sozdanii-raspredelennoy-sistemy-vyyavleniya-i-predotvrascheniya-ataki-tipa-arp-spoofing
- Shishov, N. V., & Lomazov, V. A. (2022). Modelirovanie protsessov funktsionirovaniya sistemy elektronnogo dokumentooborota pri vozdeistvii ARP-spoofing atak [Modeling of electronic document management system functioning processes under ARP-spoofing attacks]. IVD, 2(86). https://cyberleninka.ru/article/n/modelirovanie-protsessov-funktsionirovaniya-sistemy-elektronnogo-dokumentooborota-pri-vozdeystvii-arp-spoofing-atak
- Aliev, R. M. (2019). Razrabotka metoda obnaruzheniya atak tipa ARP-spoofing [Development of a method for detecting ARP-spoofing attacks]. Shag v nauku, 2. https://cyberleninka.ru/article/n/razrabotka-metoda-obnaruzheniya-atak-tipa-arp-spoofing
- Uymin, A. G. (2024). Kompyuternye seti. L2-tekhnologii: Praktikum dlya SPO [Computer networks: L2 technologies. A practical guide for secondary vocational education]. Profobrazovanie; IPR Media. https://www.iprbookshop.ru/135231.html
- Kali Linux and man-in-the-middle attacks: Empowering ethical hackers. (n.d.). Cyber Pratibha. https://cyberpratibha.com/kali-linux-man-in-the-middle-attack-tutorial/?amp=1
- ARP-spoofing in Ettercap. (n.d.). LabEx. https://labex.io/ru/tutorials/nmap-spoof-arp-in-ettercap-549950
- Ettercap: rukovodstvo po MITM-atakam v lokalnoi seti [Ettercap: A guide to MITM attacks in a local network]. (n.d.). Habr. https://habr.com/ru/articles/934772/
License
Copyright (c) 2026 P. A. Berezhnaya, K. D. Mirchevski (Author)