ARP poisoning

Whenever any device intends to communicate with another device, the requesting device sends a broadcast to the whole subnet. Then, the device to which the IP address belongs replies with its MAC address using a unicast packet. Through this approach, devices in local area network communicate with each other. A MAC address (physical address) table stores MAC address with its corresponding port number/IP address.

Use the arp -a command to populate the ARP table entries on your machine. The same command on a majority of platforms.

The following are some details pertaining to the local network we will be using for understating:

Device
IP address
MAC address

Router (default gateway)

192.168.1.1

D0:5B:A8:07:73:6C

Get Wireshark 2 Quick Start Guide now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.