ARP spoofing, also known as ARP poisoning, is a common attack used to intercept traffic on a local network—often as part of a Man-in-the-Middle (MITM) strategy. Wireshark is a powerful tool that can help you detect and confirm whether your network is under such an attack.

In this article, you’ll learn how ARP spoofing works, what it looks like in packet captures, and how to use Wireshark to identify suspicious ARP behavior.

What Is ARP Spoofing?

The Address Resolution Protocol (ARP) is used to map IP addresses to MAC (hardware) addresses on a local network. When a device needs to send data to another on the same LAN, it broadcasts a request: “Who has IP 192.168.1.1? Tell 192.168.1.100.”

The legitimate device replies with its MAC address. However, ARP lacks authentication. An attacker can forge ARP replies, falsely associating their own MAC address with another IP (e.g., your gateway), tricking devices into routing traffic through them.

This opens the door to:

• Packet sniffing
• Traffic manipulation or injection
• Credential theft

Symptoms of ARP Spoofing / MITM

Step 1: Start a Capture on Your Local Network Interface

Open Wireshark.

Choose your active Ethernet or Wi-Fi adapter.

Apply the capture filter:

arp

This limits captured traffic to ARP packets only.

Step 2: Observe ARP Traffic in Real Time

Legitimate ARP traffic usually looks like this:

• A request, followed by a reply
• Example:
• Request: Who has 192.168.1.1?
• Reply: 192.168.1.1 is at AA:BB:CC:DD:EE:FF

Suspicious behavior includes:

• ARP replies without requests
• Multiple ARP replies from different MACs claiming the same IP address
• Excessive unsolicited ARP replies

Step 3: Use Display Filters for Deeper Analysis

After capturing some data, use this Wireshark display filter to view only ARP replies:

arp.opcode == 2

This shows all ARP responses. Scroll through and check:

• Are there multiple replies for the same IP from different MAC addresses?
• Do some MAC addresses appear too often, especially unsolicited?

To find multiple MACs claiming the same IP, sort the "Info" or "Source" columns and look for inconsistency.

Step 4: Use the Endpoint and Conversations Statistics

Go to:

• Statistics → Endpoints → Ethernet

Check for the same MAC used with multiple IPs.

• Statistics → Conversations → Ethernet

Look for abnormal MAC address activity.

Step 5: Mark and Track the Suspect

Once you spot a suspicious MAC address:

• Use the display filter to isolate it:

eth.src == aa:bb:cc:dd:ee:ff

• Track all ARP replies it sends.
• See if it’s claiming to be the default gateway or DNS server.

Tip: If the attacker is spoofing your gateway IP, you might also see redirected DNS or HTTP/HTTPS traffic.

How to Prevent or Respond to ARP Spoofing

• Use static ARP entries on critical hosts.
• Enable dynamic ARP inspection (DAI) on managed switches (enterprise networks).
• Segment your network with VLANs.
• Use HTTPS and encrypted protocols to mitigate sniffing.
• Detect and log changes with IDS tools like Snort or Suricata.
• Run ARP scanning tools like arpwatch, arpscan, or XArp.

If you identify an attack:

• Disconnect the suspect MAC address (or block it via firewall/switch).
• Change passwords (if credentials may have been sniffed).
• Review logs for data exfiltration or lateral movement.