Lion Cipher Lab
Detect ARP spoofing (man-in-the-middle) on your own LAN
- SOC Analyst / Blue Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
ARP is the quiet little protocol that glues an IP address to a physical network card on your local network, and it was designed in 1982 with zero authentication. That single gap is why an attacker sitting on the same Wi-Fi as you — a coffee shop, an office, a dorm — can silently wedge themselves between you and the router and read or tamper with your traffic. This is a real, common technique that defenders are expected to recognise (MITRE tracks it as ARP Cache Poisoning, T1557.002). The good news: the attack leaves an unmistakable fingerprint in your own ARP table and packet capture, and you…
What you'll learn
- how ARP works
- reading the ARP table
- spotting ARP cache poisoning
- arpwatch monitoring
- ARP analysis in Wireshark
- defences: DAI, static ARP, encryption
Steps in this lab
- The one rule: your own LAN only
- What ARP actually is (in plain terms)
- Read your own ARP table
- Why ARP is so easy to abuse: no authentication
- The tell-tale sign: two IPs, one MAC
- Watch ARP in Wireshark on your own LAN
- Optional: let arpwatch stand guard (Mac/Linux)
- Harden against it: DAI, static entries, encryption
- What you can now do — and where it goes next