I need some help in understanding the technique of Genians/Trustwave NAC regarding ARP poisoning. As seen here Bypassing Trustwave NAC, it looks like a good method, but I don't simply get it. With ARP poisoning, the NAC device should send an ARP reply to any device which isnt on the trusted list. But this reply must be faster than reply of legitimate computer within network. What happens if any computer which is alive, answers faster for that ARP who-has packet? Any good explanation regarding this NAC technique?

1 Answer 1


Both of those NAC products use Gratuitous ARP, not answering to the who-has packets to win the race.

  • 2
    It would be helpful if you quoted or referenced where you found your answer. Or, you could delete the question if you feel the answer was too obvious.
    – schroeder
    Jan 15, 2019 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.