ARP Spoofing in a PCAP: Find the Poisoner
A user on the third floor reports certificate warnings and a slow connection, and the switch logged MAC flapping for the gateway address. The network team mirrored the access switch for a minute and handed you the capture.
The LAN is 10.40.8.0/24 and its gateway is 10.40.8.1. Find out who is claiming to be the gateway, whose traffic is affected, and whether it is being intercepted. Everything in this file is synthetic: documentation IP ranges, .example names and made-up hardware addresses.
What you will find in the capture
- Normal ARP, DNS and encrypted web traffic from two workstations
- ARP replies that nobody asked for, repeated every couple of seconds
- The same IP packets appearing twice with different MAC addresses
ARP Spoofing in a PCAP: Find the Poisoner
A user on the third floor reports certificate warnings and a slow connection, and the switch logged MAC flapping for the gateway address. The network team mirrored the access switch for a minute and handed you the capture.
The LAN is 10.40.8.0/24 and its gateway is 10.40.8.1. Find out who is claiming to be the gateway, whose traffic is affected, and whether it is being intercepted. Everything in this file is synthetic: documentation IP ranges, .example names and made-up hardware addresses.
You will practise
- Read ARP requests and replies and the IP-to-MAC claims they make
- Tell a legitimate gateway reply from an unsolicited, spoofed one
- Write a display filter that isolates spoofed ARP replies
- Follow the victim’s traffic at layer 2 and recognise forwarding by a man in the middle
- Decide the containment and the follow-up for an ARP poisoning incident
7 questions. Each hint costs 25% of that question’s points; a wrong try costs a little. Your score is out of 100.
Loading the capture…
Loading…
Sample report · illustrative data
Sample result: Cleartext HTTP Login case
Example run of the starter case on a synthetic capture (documentation and private IP ranges, .example names, a made-up account).
Scoring
- Score
- 82/100 (example)
- Grade
- B, solid analysis
- Hints used
- 2 (example)
- Time
- 6m 40s (example)
Findings in the example run
| Question | Filter that finds it | Read |
|---|---|---|
| Where is the login submitted? | http.request.method == "POST" | One POST to the intranet over port 80 |
| What crossed the wire? | http.file_data contains "username=" | Username and password readable as typed |
| Did it work? | http.response.code == 302 | Redirect plus a session cookie without Secure |
Recommended next steps (example)
- Serve the intranet over HTTPS only, with HSTS and Secure cookies
- Reset the exposed password and end the account's sessions
- Search wider captures for other cleartext logins
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
Downloads
Take the capture into Wireshark or your own tools, and keep the analyst report with the answer key.
22.6 kB · 125 packets · SHA-256 c70fc64485411789a2f9beaa8e273edf01628ed3bb73b66a284bfdccb4be119d
Sample of the debrief
This capture shows ARP cache poisoning on an office LAN. One workstation sends unsolicited ARP replies that bind the gateway’s IP to its own MAC (to the victim) and the victim’s IP to its own MAC (to the gateway), then forwards the traffic so the connection keeps working while every packet passes through it.
The full debrief, with next steps and the MITRE ATT&CK mapping, appears when you finish the case.
What you will learn
- Read ARP requests and replies and the IP-to-MAC claims they make
- Tell a legitimate gateway reply from an unsolicited, spoofed one
- Write a display filter that isolates spoofed ARP replies
- Follow the victim’s traffic at layer 2 and recognise forwarding by a man in the middle
- Decide the containment and the follow-up for an ARP poisoning incident
Frequently asked questions
How do you detect ARP spoofing in Wireshark?
Filter ARP replies for the gateway’s IP: arp.opcode == 2 && arp.src.proto_ipv4 == <gateway IP>. If more than one sender MAC claims that IP, or replies arrive that nobody requested, the cache is being poisoned. Wireshark also flags duplicate IP address use in its expert info.
What is a gratuitous or unsolicited ARP reply?
An ARP reply sent without a matching request. Hosts use gratuitous ARP legitimately to announce an address change, but most operating systems accept unsolicited replies and overwrite their cache, which is what ARP spoofing abuses.
How can you tell the attacker is forwarding traffic?
Each victim packet appears twice: first sent to the attacker’s MAC, then from the attacker’s MAC to the real gateway, with the same IP ID and a TTL one lower. Without forwarding, the victim would simply lose its connection.
Does HTTPS protect against ARP spoofing?
It protects the content: the attacker sees encrypted records, not the data, as long as the user does not accept a bad certificate. It does not hide which servers the victim talks to, and it does not stop the attacker blocking traffic.
Is this real traffic?
No. PlayCISO generated it from a fixed seed with private and documentation IP ranges, .example names and locally administered MAC addresses. The TLS records are random bytes.