Network › Module 6 › Lesson 2
Poisoning as an Idea Not a Cookbook
Name the lie (a false IP→MAC row) — never arpspoof, ettercap, or a shared LAN.
Visual · arp_poison_idea
Poisoning = THIS host caches a false MAC for an IP. Name it. Do not perform it. http://192.168.0.1/ YOUR lab.
Opening
Poisoning is a name for a lie in the notebook. This lesson names the lie. It does not teach you to tell it.
Lesson 1 showed that THIS host will send frames to whatever MAC currently sits on an IP row. If that row is wrong, the frames go to the wrong NIC. “ARP poisoning” is the industry nickname for causing that wrong row. Cyberlium will say the nickname once, then refuse the recipe. No packet crafts. No tool flags. No “lab” that injects ARP on a dorm switch. Original Cyberlium.
1. The idea, in one honest sentence
If THIS host believes a false IP-to-MAC mapping, it will deliver local frames to the wrong hardware address. That can place an unexpected station on a path you thought was “just the gateway.” End-to-end TLS still matters for web; it does not make a wrong first hop “fine” for every protocol you run.
That sentence is literacy. A cookbook would be timings, spoofed replies, and which flags to pass a MITM suite. Those are out. Naming a risk is not the same as performing it. Classroom curiosity does not authorize forging neighbor traffic on a network you do not solely own.
2. What you are allowed to observe instead
On a network you administer, a gateway MAC that suddenly disagrees with the sticker, the admin page of a device you own, or a baseline you recorded when the LAN was healthy, is a signal. The response is isolate, compare, and document — not “try the attack to confirm.”
Managed shops add features with names like Dynamic ARP Inspection. This course does not configure a campus switch. You record that such controls exist, then you stay on YOUR host's table.
Command guide
What you are allowed to observe instead
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: ifconfig
Windows: Use: ipconfig
═══ COMMANDS ═══
Command — copy this
powershell.exe -NoProfile -Command "Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Format-Table NextHop,InterfaceAlias -AutoSize" || ip -4 route show default
3. Search results are not homework
Search engines will happily offer arpspoof one-liners and ettercap “unified sniffing” screenshots. Those pages are not this lesson. If a command would send a neighbor lie, it is wrong here even on “my Wi-Fi” when roommates, guests, or ISP gear share the broadcast domain.
The right artifact is a dated note: idea named, tools refused, DEMO identified or STOPPED. Next lesson is how a defender actually looks at the table you already have.
4. What you ship: a named risk and a hard refusal
One sentence for the idea (false IP→MAC row steers local frames). One sentence that ettercap/arpspoof/bettercap are out. / STOP if router. No forged ARP. No café “practice.”
5. What you record before the next lesson
Date. Poisoning named as a false cache row. Tools refused. DEMO identified/STOP. SAFE File t11-m06-l02-poison-idea.txt chmod 600.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Follow an arpspoof tutorial “just to see.” Run ettercap on school Wi-Fi. Forge replies on a roommate's mesh “because you pay the bill.”
Right
Write the idea. Write the refusal. Leave other people's traffic alone. Next: Defender Checks on YOUR Table.
Mission: name poisoning without performing it
1) / STOP if router. 2) Write the false-row sentence in cyberlium-lab. 3) Write that ettercap and arpspoof are not this course. Do not send ARP replies. Do not scan the LAN.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor why a wrong gateway MAC is an incident signal — not which flags make ettercap “work in a lab.”
Knowledge Check
APPLY: A blog pastes an arpspoof command “to learn MITM on any Wi-Fi.” Cyberlium says:
Multiple choice
Knowledge Check
APPLY: True or False: HTTPS makes a poisoned first-hop MAC harmless for every protocol on the laptop.
True or False
Knowledge Check
APPLY: You administer a home AP you own and the gateway MAC in YOUR table no longer matches the sticker. First move?
Multiple choice