What is ARP poisoning?
ARP poisoning, also called ARP spoofing, is a local-network attack that lets an attacker intercept traffic between two hosts. The Address Resolution Protocol maps an IP address to the hardware (MAC) address that owns it, and it carries no authentication: a host will cache whatever reply it receives, even one it never asked for. By flooding a victim with false replies, the attacker rewrites the victim's view of who holds which address.
How the attack places the attacker on the path
The usual play targets the default gateway. The attacker tells the victim that the gateway's IP now belongs to the attacker's MAC, and tells the gateway the same lie about the victim. Both machines start sending their frames to the attacker, who forwards them on so the connection keeps working while the attacker reads, records or alters what passes through. That on-path position is the whole point; what the attacker gains from it depends on whether the traffic is encrypted.
What it looks like on the wire
Because the attack rewrites address mappings, the clearest evidence is two IP addresses that resolve to the same MAC. On a host, the ARP cache shows the gateway sharing a hardware address with an ordinary workstation. A packet analyzer sees a steady run of unsolicited ARP replies for the gateway and will often flag the duplicate address use outright. Users may notice only slower browsing or a certificate warning they are tempted to click through.
How to defend against it
The protocol has no fix of its own, so the controls live on the switch and in design. Dynamic ARP Inspection checks each ARP reply against a trusted table of which MAC legitimately holds which IP, built from DHCP snooping, and drops the forgeries. Static ARP entries pin critical hosts so no reply can change them, and network segmentation shrinks how many hosts an attacker can reach, since ARP works only inside one broadcast domain. An attacker therefore needs a foothold on the same VLAN or wireless segment as the victim.
ARP poisoning on the CompTIA Security+ exam
This is one of the on-path network attacks under SY0-801 objective 2.5. The scenario marker is a host whose gateway and some other workstation share one MAC address, or a complaint of a certificate warning on an internal LAN. Separate it from MAC flooding, which overwhelms the switch's address table rather than a host's cache, and from a rogue DHCP server, which hands out bad settings from the start. When the question asks for the switch feature that stops it, the answer is Dynamic ARP Inspection backed by DHCP snooping.