Project 46: ARP Poisoning Detection

Module: Module 5: Password Attacks, Network Defense & Vulnerability Management  |  Level: Intermediate  | 
Primary tool: arpwatch / XArp (free)  |  Estimated time: 75–120 minutes

Objective: Deploy a detection tool for ARP poisoning and verify it alerts correctly.

Free lab environment

Your own isolated access point + Aircrack-ng test lab — https://www.aircrack-ng.org/doku.php?id=newbie_guide

Wireless attack/defense techniques must only be run against a Wi-Fi network and access point you personally own and control, e.g. a spare router configured in an isolated room, or a virtual AP built with `hostapd` on a Linux VM. Do not test against your ISP-issued home router if it is shared with neighbors’ devices, and never test networks you do not own or have explicit written permission to test.

Lab workflow

1. Before anything else, confirm in writing that the wireless network in scope is one you personally own or have explicit permission to test — this is non-negotiable for every wireless project.
2. Put your wireless adapter into monitor mode and confirm it with arpwatch / XArp (free) before attempting any capture.
3. Run your capture/test against your own isolated virtual LAN and record the raw output.
4. Focus specifically on how to deploy a detection tool for ARP poisoning and verify it alerts correctly — annotate exactly which field or packet told you this.
5. Change one variable (e.g. passphrase strength, encryption type) and re-run the same test so you have a direct before/after comparison.
6. Document your isolation setup (which proves the test stayed inside your own authorized lab) alongside your findings.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• arpwatch/XArp’s baseline output
• its alert output during an authorized, isolated poisoning test you ran against your own lab

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.