An ARP table keeps multiple MAC addresses for an IP address or a single one?

Question

Some ARP spoofing texts say that this man-in-the-middle attack overwrites the intended target MAC with the attacker's MAC in the ARP table (e.g. https://en.wikipedia.org/wiki/ARP_spoofing , Question regarding arp spoofing)

Other says that it creates a duplicate IP entry for the same MAC address (https://www.thesslstore.com/blog/everything-you-need-to-know-about-arp-spoofing/):

However, if an attack were occurring, it would look something like what you see below. The duplicate MAC addresses corresponding to two different IP addresses (circled in red) are the smoking gun:

1. In case of two hosts sending ARP responses with distinct MAC addresses, the requester creates duplicated entries in the ARP table or keeps only the latest?

2. Why are 2 IP addresses mapped to a single MAC address an evidence of ARP spoofing? Isn't the ARP spoofing evidence the other way around (2 MAC addresses mapped for same IP)? I'm assuming here that the requester creates duplicated entries in the ARP table when it receives 2 ARP replies with different MAC addresses for the same IP (former option in question 1)

Answer 1

With no attack, an ARP table might look like:

192.168.0.1    11-11-11-11-11-11
192.168.0.20   22-22-22-22-22-22
192.168.0.30   33-33-33-33-33-33  <--about to attack

When the attack launches, an entry in the ARP table is overwritten with the attacker's MAC.

192.168.0.1    11-11-11-11-11-11
192.168.0.20   33-33-33-33-33-33
192.168.0.30   33-33-33-33-33-33  <--attacking

So, yes, there are multiple IP entries for the one MAC. And yes, the table entry is overwritten. So the 2 articles are saying the same thing. They do not contradict.

ARP is very simple, so the table is updated with the latest broadcast, which is why arpspoofing tools send out broadcasts frequently.

Answer 2

You're assuming that the network interface (or MAC address) used for the attack already has a legitimate IP address.

This is not a requirement to deploy an ARP spoofing attack.

So, it's entirely possible to spoof ARP without producing repeated entries in the ARP table.

And the double entries are not a smoking gun. One entry could be a host and the second a virtual machine on that host bridged to the LAN.

If you want to detect ARP spoofing, you need to look for unusual ARP traffic.

Answer 3

1. In case of two hosts sending ARP responses with distinct MAC addresses, the requester creates duplicated entries in the ARP table or keeps only the latest?

ARP maps IP addresses to MAC addresses; it's used when a host has the IP address and needs the underlying hardware address to be able to send the packet. It doesn't make much sense to expect to find the same IP address in two places at the same time, so the hosts only keep one entry in the table.

(Sending the same packet to two independent receivers either in a round-robin manner or by duplicating everything could be useful in some cases, but stateful protocols like TCP would get confused. E.g. one receiver would immediately send a TCP reset when it saw a segment to a connection it didn't know anything about. So it's not really useful on that level, but you could do something like this higher on the stack, like on top of UDP.)

2. Why are 2 IP addresses mapped to a single MAC address an evidence of ARP spoofing?

It isn't. Not as such. The article assumes that the host doing the spoofing would be available via two different IP addresses. Perhaps so that the .43.220 address would be its legitimate address, and .43.1 a router it was spoofing. But a host trying to spoof the router would not need to be available under another IP address to the victim client. It might want to do similar spoofing in the other direction, to present itself as the victim client to the network router, but again, it only needs to present one IP address there.

(Unless of course it spoofs every client on the network to the router. But even then, I can't see a reason why it would be impossible to spoof each with a different MAC address.)

Two IP addresses mapping to just one MAC address could also be evidence of a host that just has two IP addresses configured for the same interface (for whatever legitimate reason). Or perhaps of something like proxy ARP where one host answers ARP queries for all addresses on a network block with its own MAC address.

Isn't the ARP spoofing evidence the other way around (2 MAC addresses mapped for same IP)?

Yes. Except that you won't have the two MAC addresses mapped for the same IP at the same time.

Your usual OS won't keep track of the ARP packets/mappings seen, other than the last one, and won't think twice of updating its cache based on any new ARP replies it gets, so without special tools, you might well miss anything being wrong. There's software like arpwatch specifically made to monitor ARP messages seen on the network and to keep history of them. With that, it's possible to send warnings if an IP address is seen to frequently "move" from one MAC to another.