ARP – Address Resolution Protocol – maps an IPv4 address to a MAC address on the local Layer 2 network.

Traditional ARP has no built-in authentication.

Normal ARP exchange

Victim → Broadcast:
Who has 192.168.1.1?
Tell 192.168.1.20
Gateway → Victim:
192.168.1.1 is at aa:aa:aa:aa:aa:aa

ARP only resolves the next local hop, so even when the IP destination may be a remote web server, the Ethernet destination is simply the local gateway.

So when sending packets outside its subnet, the victim builds frames with:

Ethernet destination MAC = aa:aa:aa:aa:aa:aa
IP destination           = remote internet server

What ARP poisoning does

ARP poisoning manipulates devices’ ARP caches by sending false ARP information.

Now introducing an attacker:

Attacker:
IP  = 192.168.1.50
MAC = cc:cc:cc:cc:cc:cc

The attacker wants the victim to believe:

192.168.1.1 → cc:cc:cc:cc:cc:cc

The victim may accept this and overwrite its legitimate ARP-cache entry:

Before:
192.168.1.1 → aa:aa:aa:aa:aa:aa
After poisoning:
192.168.1.1 → cc:cc:cc:cc:cc:cc

Now frames intended for the gateway are sent to the attacker’s MAC address.