Analyzing ARP to Discover & Exploit Stale Network Address Configurations

This post introduces eavesarp, a Linux tool that passively and actively analyzes ARP traffic to identify Stale Network Address Configurations (SNACs), then demonstrates how adversaries can exploit SNACs via IP aliasing and packet rewriting to intercept UDP (e.g., syslog) and TCP (e.g., SMB) traffic and harvest credentials. It provides step-by-step offensive workflows, example lab scenarios, and concludes with defensive recommendations such as Dynamic ARP Inspection, monitoring anomalous ARP/DNS behavior, and tarpitting.