The security payoff: three classic attacks — ARP spoofing, DNS spoofing, machine-in-the-middle — and why the capture skill you just built is how they are caught.
Where Networks Break
In brief
Objectives
- Explain how ARP and DNS spoofing work
- Describe the machine-in-the-middle position
- Name the detection and the defence for each
Now the security payoff. The same trust that makes networks work also makes them attackable. Three classic attacks all exploit one thing: a machine believing an address claim it should have questioned.
ARP spoofing
On a local network, machines ask "who has this IP?" and trust whoever answers. An attacker simply answers first, with their own MAC address, and traffic meant for the gateway flows through them instead. This is a machine-in-the-middle position.
DNS spoofing
Your machine asks "what is the address of bank.dz?" If an attacker answers before the real server, you connect to their machine believing it is the bank.
Defence
These attacks are loud on the wire. ARP spoofing produces duplicate MAC-to-IP mappings; DNS spoofing produces answers from unexpected sources. A capture — the skill you just built — is exactly how they are detected. Static ARP entries, DNSSEC and encrypted DNS are the mitigations.
Legal
Demonstrate these only on a lab network you built yourself, against machines you own. Running them on a real network is unauthorised interception under Law 09-04.
Recap
- These attacks abuse a machine trusting an address claim
- They are loud on the wire and visible in a capture
- Static ARP, DNSSEC and encrypted DNS defend against them