L27
Spoofing, on-path attacks and ARP
Cram this first — memory hook
Address Resolution Protocol poisoning changes the address book; Media Access Control spoofing changes the name badge; on-path changes who stands between the speakers.
Exam trap
is local-link IPv4 resolution. IPv6 uses different neighbor-discovery mechanisms. addresses alone are weak identity proof.
The slide facts
Spoofing impersonates trusted identities or network information. poisoning changes address mappings; spoofing copies/changes a device identity. Both can support interception or access-control bypass.
If you have time — extra
Media Access Control () addresses identify interfaces at the local link layer. Address Resolution Protocol () maps local IPv4 addresses to link-layer addresses. A device sending an IPv4 packet to its gateway needs the gateway's local address; it does not for every remote internet server. poisoning supplies false mappings so traffic may be sent through the attacker. spoofing instead changes or imitates the address used by a device. An on-path attacker is positioned to observe or alter a communication path. Spoofing can help create that position, but impersonating an address alone is not always an on-path attack. Dynamic Inspection () can validate messages, commonly using trusted Dynamic Host Configuration Protocol snooping bindings. Static hosts need appropriate legitimate bindings or policy. Authenticated encryption reduces the harm of interception but does not fix every local-network denial of service.
Walkthrough
Compare the expected gateway/address binding with observations, examine and switch evidence, verify approved network changes, identify suspicious movement, and apply appropriate inspection/access controls.