What does ARP spoofing involve?

• A. Sending legitimate ARP requests to impersonate another device.
• B. Sending fake ARP replies to impersonate another device.
• C. Broadcasting ARP requests to all devices to measure latency.
• D. Blocking ARP traffic on a switch.

Answer: (B)

ARP spoofing relies on sending forged ARP replies to map the attacker’s MAC address to another device’s IP on the local network. The ARP protocol is used to translate IPs to MAC addresses, and devices typically trust ARP replies they receive. By continuously sending fake ARP replies that associate the attacker’s MAC with the target device’s IP (often the gateway), the attacker poisons ARP caches elsewhere in the LAN. This causes traffic intended for that IP to be sent to the attacker, enabling interception, modification, or disruption—classic man-in-the-middle or denial-of-service effects. The other scenarios describe legitimate ARP activity, network probing, or defensive blocking, none of which enact spoofing.