Glossary: Network Attacks, Social Engineering and Indicators

ARP poisoning

Also written: ARP spoofing, ARP cache poisoning, T1557.002

Sending false ARP replies so that victims link an IP address, usually the gateway's, to the attacker's MAC address and send their traffic to the attacker. The classic sign is two IP addresses, one of them the gateway, sharing one MAC address.