Does the term "MITM attack" refer to what happens once an attacker is between two hosts or to attacks like ARP poisoning, DHCP snooping that allow the attacker to insert himself between two hosts in the first place?


A MiTM attack refers to the high level concept of intercepting traffic from host A, reading it, and/or modifying it, and then sending it to the original destination B, as if A sent it.

The techniques to accomplish this are an entirely different matter. It might entail ARP poisoning, physically tapping a line, DNS attacks, sniffing wireless traffic, or even secretly stealing a briefcase of secret documents carried by a courier.

  • Thanks Steve. If I understand correctly, what's called a MiTM attack is the situation where an attacker is able to read/modify between two hosts. Techniques like ARP poisoning, dhcp snooping or icmp redirect lead to a MiTM attack? – yusuf Jul 1 '16 at 15:07
  • @yusuf Yes. The other things you describe are technology specific ways that a MiTM attack can occur. – Steve Sether Jul 1 '16 at 23:17

MITM (Man in the Middle) is a specific attack aimed at communications that is meant to be exclusively between multiple parties. The other references you mention - ARP poisoning and DHCP snooping - are their own attacks and wouldn't qualify as MITM since they aren't reading communications exclusive to select parties.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.