ARP and “Who Is Where” as a Concept

When a host must send to another IPv4 address on the same subnet, it checks its ARP cache (neighbor table). Hit: it already has a MAC and can build the Ethernet frame. Miss: it broadcasts an ARP request — “who has this IP?” — and the owner of that IP should unicast a reply with its MAC. The cache stores the pair so the LAN is not flooded for every packet. Off-subnet traffic is different: you do not ARP 93.184.216.34. You ARP the default gateway IP. The frame’s destination MAC is the router’s LAN MAC; the IP header still names the remote destination. That split is why a wrong gateway MAC is dangerous: Layer 3 still says “internet,” Layer 2 may be delivering to whoever answered.

IPv6 uses Neighbor Discovery, not ARP; the defender idea is the same — next-hop Layer 2 address should be stable for a given gateway you own. Incomplete or failed entries often mean nobody replied: host down, wrong subnet, or filtering — not a license to scan the rest of the /24, and not a license to inject replies. Topic 3 already treated ARP as LAN literacy. Module 8 only needs the sniffing-shaped sentence: the neighbor table is how a local observer knows “who is where,” and forging that table against people who did not invite you is out of this course.

ip neigh || arp -a | head -n 20

cat >> "$NOTES" << 'EOF'
arp_means: IP to MAC on the local link
this_command: MY neighbor table, not a LAN attack map
EOF

Unsigned ARP means a host could claim “the gateway IP is at MY MAC.” If victims cache that lie, their outbound frames go to the liar, who may copy or alter traffic that is not protected end-to-end. That is a local man-in-the-middle risk. HTTPS still protects web payloads (Lesson 3 / Topic 8). It does not make a poisoned gateway “fine” for every cleartext protocol, and it does not make forging ARP legal. This course does not teach how to poison. No attack commands. No ettercap. No arpspoof. No gratuitous-ARP weapon lab. No “practice on the roommate’s laptop.” Classroom curiosity does not authorize it.

If a blog titled with a cert acronym prints a spoof cookbook, that blog is not this lesson. Original Cyberlium teaching stops at mechanism plus detection. You may describe the risk in one paragraph in your notes. You may not paste a command that injects ARP on a shared network. You may not “verify” by attacking anyone. The next heading is how defenders notice the lie without becoming the liar.

On a network you administer, know the real gateway MAC: router sticker, admin page of a device YOU own, or a baseline you recorded when the LAN was healthy. Read YOUR neighbor table (arp -a, arp -n, or ip neigh). If the MAC for the default-via IP suddenly changes to a strange vendor OUI, or flaps between two MACs, and you did not replace hardware, treat it as a signal: isolate, compare to known-good, look for an unexpected device on a LAN you own. Do not “fix” it by poisoning back. Do not launch ettercap to “reclaim” the gateway. Detection is a cache diff plus physical or admin-plane inventory.

Managed networks add controls you should be able to name without configuring a stranger’s switch: Dynamic ARP Inspection (DAI) with DHCP snooping so a port cannot claim arbitrary IP-to-MAC pairs; 802.1X so unknown stations do not sit on the data VLAN; port security. Home users still win by noticing “gateway MAC is not the box I bought.” Static ARP for a gateway on a box YOU own is a narrow hardening idea some operators use — still not a recipe to overwrite a roommate’s cache. Write the detection sentence. Skip the weapon.

Read-only. You are listing what THIS host already learned. You are not sending crafted ARP, not flooding, not targeting other stations. If you have no LAN (loopback only), write that honestly — the definitions still complete the lesson. Windows: arp -a in PowerShell. WSL/Git Bash: ip neigh or arp -a. chmod 600. Do not add a second host because your table looked small.

arp -a | head -n 8
cat >> "$NOTES" << 'EOF'
notice: duplicate MAC for a gateway IP is a clue on MY LAN
control_names: DAI / DHCP snooping / static ARP for MY gateway — on gear I own
refuse: spoof-back
EOF

You now can say ARP is “who is where” on a local link, that unsigned replies are a poison risk, and that defenders notice by comparing a gateway MAC to a known-good — never by practicing spoof against a roommate. Notes are locked. This is original Cyberlium teaching, not official CEH, not a cert, not dumps. Next — Why HTTPS and VPNs Change the Picture — encrypted payloads versus leftover metadata, carrying Topic 8 TLS into the sniffer’s window.