# What is ARP spoofing, and how do we detect it on a small office network?

ARP spoofing is a device on your local network falsely announcing that it is the router or another host, so that traffic meant for them flows through it. It lets an attacker read unencrypted traffic, capture credentials or tamper with connections, and it only works from inside the same segment, for example from a compromised PC or a device plugged into a free socket. On managed switches, dynamic ARP inspection together with DHCP snooping blocks it; port security and 802.1X limit who can plug in; encrypting internal services limits the damage. Without managed switches, look for one MAC address claiming several IP addresses, especially the gateway's. A sensor on the segment sees such conflicting announcements, and the NetSenX network map shows the devices on monitored segments, so a newcomer stands out.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-arp-spoofing-and-how-to-detect-it

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Can someone on our Wi-Fi read other users' traffic?](https://netsenx.com/en/faq/can-someone-on-our-wi-fi-read-other-users-traffic)
- [How much time do we have once ransomware starts touching file shares?](https://netsenx.com/en/faq/how-much-time-once-ransomware-touches-file-shares)
- [Can we see which program on a server made a large upload?](https://netsenx.com/en/faq/can-we-see-which-program-made-a-large-upload)
- [What is a supply chain attack?](https://netsenx.com/en/faq/what-is-a-supply-chain-attack)
- [What is a zero-day, and can anything detect it?](https://netsenx.com/en/faq/what-is-a-zero-day-and-can-it-be-detected)