ARP spoofing is best described as which of the following?

• A. ARP spoofing is intercepting DNS requests to redirect traffic.
• B. ARP spoofing is sending fake ARP messages to associate attacker MAC with a victim IP.
• C. ARP spoofing is encrypting ARP packets to prevent spoofing.
• D. ARP spoofing is using ARP to map IPs to MAC addresses legitimately.

Answer: (B)

ARP spoofing is about forging ARP messages on a local network to associate the attacker’s MAC address with a legitimate IP address. On a LAN, devices use ARP to learn which MAC corresponds to which IP, and an attacker can send forged ARP replies (or requests) to poison these mappings. When other devices update their ARP tables with the attacker’s MAC for the victim’s IP, traffic meant for the victim goes to the attacker, enabling interception, modification, or disruption of that traffic. So the essence is ARP cache poisoning through fake ARP messages that mislead devices about IP-to-MAC mappings.

Interception of DNS requests describes DNS spoofing, not ARP spoofing. Encrypting ARP packets isn’t a standard defense in practice—ARP isn’t secured by encryption in normal networks. Mapping IPs to MAC addresses legitimately is standard ARP behavior, not spoofing.