Address Resolution Protocol (ARP) is a protocol that maps the IP addresses with their associated MAC addresses, based on the RFC 826 standard. ARP is implemented in many operating systems, including Linux.
You can check it using the arp command:
Attackers can exploit its cache to perform man-in-the-middle attacks using a tool such as Ettercap:
If you are already using Kali Linux, you can also use the dsniff utility:
Attackers can use the IP/MAC matching capability of the ARP protocol to map their MAC addresses with legitimate IP addresses. If you are using Kali Linux, you can use it directly from the main menu.
To defend against ARP attacks, it is better to use dynamic ARP inspection by checking whether the packets match the binding table entries, otherwise packets will be dropped; but first you need to configure DHCP snooping.
This is the normal ARP operation:
...
