A help desk ticket says the Wi-Fi in the lobby "feels slow" and that the bank's website showed a certificate warning, which the user clicked through. Another user on the same floor says her network drive briefly disconnected. None of it looks like an attack on its own. Together, those are the kind of small signs that someone has placed a device between users and the systems they talk to.
On the CompTIA Security+ SY0-801 exam, on-path attacks, sniffing, spoofing and rogue devices sit under objective 2.5, which expects you to analyze the indicators in a scenario and name the activity. This lesson covers how attackers get into the path on a local network or Wi-Fi, what they gain from capturing traffic, how address spoofing works, and how to tell these look-alike attacks apart in logs, captures and user reports.
An on-path attacker sits between two parties and relays their traffic
An on-path attack, formerly called a man-in-the-middle attack, places the attacker between two systems that think they are talking directly to each other. The attacker relays the traffic so the conversation keeps working, and in the meantime can read it, record it, change it, or inject new messages. A related variant, sometimes called man-in-the-browser, puts malicious code inside the victim's browser instead of on the network, where it can alter transactions after they are decrypted.
Getting into the path is the hard part, and it usually means abusing a protocol that trusts whatever it hears. On a local network that means ARP and DHCP. On Wi-Fi it means a fake access point. Further out it means DNS, which has its own lesson in this section.
Once in the path, what the attacker gains depends on encryption. Traffic in cleartext can be read and changed freely. Traffic protected by TLS can't be read unless the attacker can make the victim accept a forged certificate, which is why certificate warnings matter so much. A user who clicks through a warning on a site that normally works is often the clearest report you'll get of an on-path attack.
Other indicators include higher latency, an extra hop in a traceroute to a local server, a certificate issued by an unfamiliar authority, and sessions that drop and reconnect while the attacker sets up. The broad defenses are encryption with real authentication, such as TLS with certificate validation and mutual authentication where it fits, and a VPN on networks you don't control.
ARP poisoning shows up as two IP addresses sharing one MAC address
Hosts on an Ethernet or Wi-Fi LAN find each other's hardware addresses with the Address Resolution Protocol. A host asks "who has 10.10.20.1?" and the owner replies with its MAC address, which the asker stores in its ARP cache. ARP has no authentication, and most hosts accept a reply even when they never asked.
ARP poisoning, also called ARP spoofing, exploits that. The attacker sends forged ARP replies telling a victim that the gateway's IP address belongs to the attacker's MAC address, and usually tells the gateway the same about the victim. Both now send their frames to the attacker, who forwards them on. The victim keeps working, often with a little extra delay.
The indicator is in the victim's ARP cache. Here is a Windows workstation whose gateway, 10.10.20.1, normally has the MAC address 3c-52-82-1a-07-e1:
C:\> arp -a
Interface: 10.10.20.57 --- 0xb
Internet Address Physical Address Type
10.10.20.1 00-0c-29-4f-8e-35 dynamic
10.10.20.44 00-0c-29-4f-8e-35 dynamic
10.10.20.255 ff-ff-ff-ff-ff-ff static
224.0.0.22 01-00-5e-00-00-16 static
The gateway's entry now carries the same physical address as 10.10.20.44, an ordinary workstation. That host is the attacker, or the compromised machine the attacker controls. In a packet capture the same attack appears as a steady stream of unsolicited ARP replies for the gateway's address, and packet analyzers such as Wireshark flag duplicate use of an IP address.
ARP only works inside one broadcast domain, so ARP poisoning requires an attacker, or malware, on the same VLAN or Wi-Fi network as the victim. Switch features stop it: Dynamic ARP Inspection checks every ARP reply against the DHCP snooping table of which MAC legitimately holds which IP, and drops forged ones. Static ARP entries for critical hosts, 802.1X on switch ports and segmentation reduce the risk further. IPv6 replaces ARP with Neighbor Discovery, which can be spoofed in the same way and has its own switch protections.