Detect ARP Poisoning with a Packet Capture

Capture live traffic, read the Address Resolution Protocol exchanges, and decide whether a host on the network is impersonating others to sit in the middle of their conversations.

SY0-701 · 2.4 On-path SY0-701 · 4.9 Packet captures
NET-OPS LAB meridian-tackle.lan
segment 10.42.7.0/24

Scenario

You are the IT security administrator for Meridian Tackle & Marine, a small coastal retailer. The showroom workstation has been dropping its link to the gateway for a few seconds at a time, and a staff member's saved store credentials appear to have leaked. You suspect a host on the LAN is poisoning ARP tables to redirect traffic through itself.

Your job: capture traffic on interface ens33 for about five seconds, study the ARP exchanges, and use the activity around 10.42.7.6 to decide whether ARP poisoning is happening — and which host is behind it.

Idle — no packets captured
Packet list — 0 frames
No.TimeSourceDestinationProtocolLenInfo
Start a capture to collect frames on ens33.

Click a row to inspect that packet's layers. ARP packets are tinted; duplicate-address warnings are highlighted.

Packet detail
No packet selected. Click a row above to expand its protocol layers.
No bytes to show.

Lab tasks

  • Capture for ~5 seconds on ens33Run a capture and let it fill, or stop it once frames appear.
  • Inspect an ARP replyClick any ARP packet to expand its layers in the detail pane.
  • Flag the poisoning hostIdentify the MAC address that claims more than one IP, then flag its host below.

Hosts observed

Which host is poisoning the ARP cache? Select the one whose MAC address is bound to more than one IP.

Analysis questions

Submit completed lab

Score 0 / 8

Your selections and score are checked in your browser and submitted with a screenshot for your instructor to review. Use a pseudonym only — keep real names out of this system.