Fix ARP Cache Poisoning on Your Network

Your network's gone weird—sites load slow or redirect to spam pages?

I bet you've been there. You're trying to get work done on your small business network, and suddenly the internet crawls. Or worse, you type in your bank's URL and end up on some fake page. Last month, a client of mine in a dental office had this exact problem—their patient portal kept showing ads for teeth whitening products. Turned out it was ARP cache poisoning.

Let's get straight to the fix before you lose more time.

The Quick Fix: Flush and Bind

First, we kill the bad ARP entries. Then we lock down the good ones. Here's how.

Step 1: Flush the ARP Cache on Windows

Open Command Prompt as admin (right-click, run as administrator). Type:

arp -d *

This removes all dynamic entries. If you're on a Mac or Linux, use:

sudo arp -a -d

This clears the cache instantly. Your network might hiccup for a second, but it'll rebuild clean.

Step 2: Find the Real IPs

Now, check what your router says. Open a browser, go to your router's admin page (usually 192.168.1.1 or 10.0.0.1), and look for a section called "DHCP clients" or "connected devices." Write down the IP and MAC address for each device you trust—the router, your main PC, the printer, the server.

Back in Command Prompt, type:

arp -a

Compare the MAC addresses against your router's list. If you see any IP with a MAC that doesn't match (like a Windows PC showing a MAC from a Chinese manufacturer), that's the poisoned entry.

Step 3: Add a Static ARP Entry

To lock the router's IP so nobody can spoof it, run this for each critical device (router first):

arp -s 192.168.1.1 00-11-22-33-44-55

Replace the IP and MAC with your router's real ones. Use dashes, not colons, on Windows. On Mac/Linux, colons work fine:

sudo arp -s 192.168.1.1 00:11:22:33:44:55

After this, the router's entry won't change until you reboot the PC. Do this on every machine on your network—yeah, it's a pain, but it stops the attack in its tracks.

Why This Works

ARP cache poisoning works because your computer trusts any device that answers an ARP request. A bad guy on your network sends fake replies saying "I'm the router" with their own MAC address. Your PC believes it, sends traffic to them, and they can spy or redirect.

Flushing the cache removes those lies. Adding a static entry tells your PC to ignore any future ARP replies for that IP—no matter what. The attacker's fake packets don't stick. It's like putting a lock on the front door instead of just yelling "I live here."

Less Common Variations

Not all ARP poisoning looks the same. Here are some weird ones I've seen.

The Silent Slowdown

No weird redirects, just random slowdowns every few hours. Usually from a cheap IoT device like a smart plug or camera that got hacked. The attacker only poisons the cache for a few minutes to steal credentials, then stops. Check your ARP cache with arp -a every hour. If you see an IP with two MAC addresses (one real, one fake), you've got it.

The Guest Network Hack

Most small business Wi-Fi routers have a guest network that isolates guests from your main network. But some cheap routers (looking at you, TP-Link Archer C7) don't isolate ARP traffic between those networks. An attacker in the guest Wi-Fi can target your main devices. Fix: disable guest Wi-Fi completely, or upgrade to a business-grade router like a Ubiquiti EdgeRouter.

The VPN Poison

If you use a VPN, ARP poisoning can intercept traffic before it hits the VPN tunnel. I fixed a client's issue where their VPN kept dropping—turned out the attacker was poisoning the ARP table of the VPN server itself. Solution: set static ARP entries on the VPN server for the default gateway.

Prevention: Stop It Before It Starts

Don't wait for the slowdown. Do these things today.

Enable Dynamic ARP Inspection (DAI) on Your Switch

If you have a managed switch (like a Cisco SG or Netgear Smart Switch), turn on DAI. It cross-checks ARP packets against your DHCP snooping database. This blocks fake ARP replies at the switch level. It's a few clicks in the interface—usually under "Security" → "ARP Inspection."

Use DHCP Snooping

This tells the switch to only trust DHCP replies from the router's port. It stops attackers from setting up rogue DHCP servers. On most smart switches, it's a checkbox.

Set Up Port Security

On your switch, limit each port to one MAC address. If a device's MAC changes (like an attacker plugging in a laptop), the switch blocks them. Usually called "port security max 1" in the CLI.

Stick to Wired Connections for Critical Devices

Wi-Fi is easy to intercept. If your server or router uses Wi-Fi, move it to Ethernet. Less chance of ARP poisoning over the air.

Monitor Your ARP Cache Regularly

Once a week, run arp -a on a couple of PCs. Look for duplicates or strange MACs. If you see something weird, investigate. I use a free tool called SoftPerfect Network Scanner that flags duplicate IPs.

That's it. ARP poisoning is a pain, but it's easy to stop once you know the tricks. If you still see issues after doing this, check if your router firmware is up to date—sometimes it's just a bug. Good luck.