ARP Poisoning

         In Ethernet network if hostA wants to communicate with hostB than hostA should know the MAC address of hostB. The ip address of every system is mapped on to its corresponding MAC address. This mapping is done with the help of ARP.

         When an ip address is to be resolved into MAC address, ARP first checks ARP cache if the MAC address of the specific ip address exists or not. If exists it sends a packet to the destination. If not ARP sends a request packet to find the MAC address, this request packet consists of source MAC and ip addresses and destination ip address. And this request packet is broadcasted in the network. If there exists a host with the specified ip address than it replies back to source with its MAC address.

        The only problem with arp is it is a stateless protocol. so it doesn't remember even if it had requested for mac of any ip address or not, so when ever a gratituous arp reply arrives it just updates the arp cache without further checking if its genuine. so arp poisoning can be easily done. ARP poisoning is sometimes the starting point for more sophisticated lan attacks like denial of service, man in the middle and session hijacking.
        The following is the code for ARP poisoning, it helps you in finding out how the attack can be practically implemented.click here