Office network attacks: ARP spoofing, man-in-the-middle and how to prevent them

How ARP spoofing and man-in-the-middle (MITM) attacks work on a local network, which other network attacks are most common, and which switch and Wi-Fi settings stop them.

OfSec 3 min read

Most companies protect their network from the internet with a firewall, while the internal network has no controls at all: every device in the office can see and connect to every other. One infected laptop, a guest on the main Wi-Fi network or an unknown device plugged into a network socket in the meeting room is enough for an attack.

ARP spoofing

On a local network, devices learn which MAC address belongs to a given IP address through the ARP protocol. ARP does not check who sends a reply, so any device can announce that it is the router. The computers on the network accept this and start sending their traffic through it.

The attacker now sits between the employees and the internet. This is a man-in-the-middle (MITM) attack. The attacker sees unencrypted traffic, can alter DNS responses and can redirect users to fake login pages.

Other common network attacks

  • A rogue DHCP server that hands computers a wrong gateway or DNS server, with the same result as ARP spoofing.
  • A fake access point using the name of the company Wi-Fi network (evil twin), which devices join automatically.
  • Scanning the internal network for shared folders, printers, cameras and NAS devices with default passwords or outdated firmware.
  • Remote desktop (RDP) or databases exposed to the internet and attacked by password guessing.

Protection

  1. Encrypt all traffic: HTTPS with HSTS for internal systems, TLS for email, VPN for remote access. Intercepted traffic is then useless, and fake pages trigger a certificate warning.
  2. Use managed switches with DHCP snooping and Dynamic ARP Inspection. They accept DHCP and ARP replies only from permitted ports and devices.
  3. Split the network into segments (VLANs): employees, servers, guests, printers, cameras and other devices. Only explicitly permitted traffic passes between segments.
  4. Run a separate guest network with client isolation, so its devices cannot see each other and have no access to the company network.
  5. Use WPA3 or WPA2-Enterprise with individual credentials (802.1X) instead of one shared password known to every current and former employee.
  6. Disable or restrict network sockets in shared areas.
  7. Set up alerts when a new device appears on the network and when the gateway's MAC address changes.

How it is tested

An internal penetration test starts from the position of a guest or an employee with ordinary access and checks how far an attacker can get from inside. The result shows which segments need to be separated and which devices need to be updated or isolated.

Network securityOffice