ARP-spoofing: why does the attacker constantly send ARP replys?

Question

I have understood the basic concept of how arp-spoofing works. However, I am struggling with the details.

Why does an attacker have to constantly send out spoofed arp-announcements to the network?

Is a client only accepting the first arp-announcement that arrives after the request for a certain MAC address of an IP address (meaning that the constantly sent out spoof-reply is faster than the reply with the actual MAC address) or are all clients regularly updating their caches by listening to arp-announcements on the network?

Answer 1

When a host sends an ARP reply without ARP request, this is a Gratuitous ARP

In your scenario, this is useful for two reasons:

• If a new host connects to the network it will receive the Gratuitous ARP and it will be automatically victim of the attack
• If a host doesn't send traffic, the entries in the ARP cache will be cleared. So with the Gratuitous ARP, the timeout is always reset.

And every client which receives the Gratuitous ARP will update their ARP cache.

Answer 2

The message sent are called a Gratuitous ARP reply which means the machine broadcasts its ARP rather than waiting for a client to ask for it. Think of it like a 'hello I'm here!'

The reason it keeps doing it is to ensure that all clients keep their ARP cache looking at the attackers MAC. Otherwise the original machine could broadcast their gratuitous ARP message 'hello I'm here!' and cause the clients to see their real MAC again.

It also continutiously sends the messages to ensure new clients see it, expiring clients get updated.