Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is WPA2 WiFi protected against ARP poisoning? If not, can the ARP poisoner decrypt the packets?

share|improve this question
up vote 16 down vote accepted

WPA2 is NOT protected against ARP poisoning.

When you perform ARP poisoning, you announce that your MAC address is responsible for a given IP address. All of this happens at a layer higher than WPA2 is aware of. Let's say layer 3. Because the WPA2 encryption link is down on layer 2, and packets destined for the attacked IP are now addressed to the attacker's MAC address on layer 2, they will be encrypted for the attacker.

Edit: Also, one should be aware of "Hole 196".

share|improve this answer
ARP is a layer 2 protocol. – fianchetto Mar 3 '11 at 20:23
Yes, strictly it belongs there. Like most things it doesn't perfectly fit, though. It is the bridging of the L3 IP to the L2 Mac that is above the access point's head, if you will. The access point is L2. While no L3 encapsulates an ARP request, there would be no ARP request without L3 in the first place. – Jeff Ferland Mar 3 '11 at 20:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.