I want to know the difference between arp and icmp mitm attacks and why someone would use icmp over arp.
I am looking for an educated response comprised of the principles behind both attacks, their typical use and maybe adv/disadv of each.
I am not a specialist, just an aspiring bioinformatician with interests in cyber security, go easy on me.
Firstly, ARP is a protocol used in a LAN to resolve the MAC address of the next or final destination IP. Therefore an ARP MITM attack works by spoofing a MAC address within a LAN in response to a victim's ARP request. If the MAC of the intended machine is successfully spoofed with the attacker's machine, then the victim will send traffic to the spoofed MAC address instead of the destination MAC address. It follows that for this attack to be successful, it must be executed within the victim's LAN. Additionally, for an ARP spoof to be effective you have to be able to respond faster than the actual destination ARP response.
An ICMP MITM attack on the other hand is accomplished by spoofing an ICMP redirect message to any router that is in the path between the victim client and server. An ICMP redirect message is typically used to notify routers of a better route (see http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13714-43.html), however it can be abused to effectively route the victim's traffic through an attacker controlled router. While this attack does not require LAN access, the disadvantage is that many routers have static routes or do not accept/process ICMP redirect packets.
