hi I have been told VLANs can help mitigate ARP poisoning because they can be configured with different broadcast domains. and arp works using a simple broadcast domain. can someone explain how the VLAN achieves this ?

  • 1
    VLANs can help mitigate ARP poisoning because they are different broadcast domains, and ARP works on a single broadcast domain.
    – user253751
    Jul 27 '16 at 1:57

When you configure a VLAN on a local network it's as if you have differents locals networks between your hosts. So if you sniff the traffic on a particular VLAN you will see only the hosts which are conected on this VLAN and not the others hosts of your network. On the switch which manage VLAN you will have a ARP table per VLAN.

Moreover, you can use the privates VLANs to improve your local security.

  • Some corrections and clarifications: if the switch has an ARP table, it's for switch management and has no bearing on forwarding traffic between ports. The switch will have a forwarding table (sometimes called a CAM table), but that's not relevant to ARP poisoning. Second, to clarify: a malicious host can only perform ARP poisoning on those other hosts on the same VLAN, reducing the attacker's targets. Still, the attacker can spoof the gateway and still intercept ingress and egress traffic for the VLAN. Private VLANs can mitigate this, as @Sorcha states.
    – Crunge
    Jul 27 '16 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.