Caution
This is a dual-use research tool. It sends spoofed ARP replies and may cause address conflicts, loss of connectivity, or denial of service when used on a regular local network. Use it only in an isolated lab network that you own or with the network owner's explicit written permission. Do not run it on a production, home, public, or any other network with real users.
ARPRift is a minimal Linux utility for exploring the ARP trust model and the impact of spoofed ARP replies on the availability of a local IPv4 segment. It is designed for reproducible experiments, defender training, and validation of detection systems in controlled environments.
The program listens for ARP requests on a selected interface and responds for IPv4 addresses within a specified range. For each address, it generates a locally administered unicast MAC address that remains stable until the process restarts. As a result, other hosts may associate the requested IP addresses with nonexistent MAC addresses, potentially making those IPs unreachable.
This is not a full implementation of a classic man-in-the-middle attack: the program does not forward traffic, intercept connection contents, or broadcast unsolicited ARP replies. It only responds to received ARP requests, demonstrating an address conflict/reservation scenario and a possible denial of service.
Before running the tool:
- Create a separate physical segment, an isolated virtual bridge, or a network namespace with no route to a production network or the internet.
- Use test hosts and a test address range only. Do not include the addresses of gateways, DNS or DHCP servers, hypervisors, or management interfaces.
- Keep an independent management path to the lab and prepare a way to stop the process in advance.
- Obtain explicit permission if you are not the sole owner of the infrastructure.
- Capture packets and metrics only where authorized, and do not publish network data that belongs to others.
A shared VLAN is not sufficiently isolated. A container alone is also not a security boundary when its network interface is connected to a real Layer 2 segment.
- Linux (
AF_PACKETis used) - Go 1.26.1 or a compatible version
CAP_NET_RAWor root privileges- An isolated test network
Granting the capability to the binary allows it to create raw packet sockets. Treat such a binary as a privileged tool and remove the capability after the experiment.
go build -o arprift .
sudo ./arprift -interface <lab-interface> -range <lab-ip-or-range>The -range flag accepts an IPv4 CIDR, an inclusive START-END range, or a
single IPv4 address. The tool intentionally processes the entire supplied CIDR,
including its network and broadcast addresses. Select the smallest range needed
for your experiment.
To run without remaining logged in as root, grant the capability to the compiled binary:
sudo setcap cap_net_raw=ep ./arpriftRemove it after the experiment:
sudo setcap -r ./arpriftStop the process with SIGINT (Ctrl-C) or SIGTERM. The program does not
modify the host's system ARP tables and requires no cleanup of its own after a
normal shutdown. However, spoofed entries may remain in the ARP/neighbour caches
of test hosts until they expire. If necessary, clear the cache on each test host
using the operating system's standard tools, or restart its network interface.
Do not perform bulk cache clearing on a production network.
If the lab segment unexpectedly loses connectivity, stop the process immediately, physically or logically disconnect its interface from the segment, and only then begin recovering the test hosts.
Unit tests do not create raw sockets or send packets over the network:
go test ./...Run all integration tests in an isolated lab environment only.
You are responsible for complying with applicable laws, contracts, and the network owner's policies. Access to the source code and license does not grant permission to attack systems owned by others. Do not use this project to disrupt availability, bypass access controls, intercept traffic, or conceal activity.
If your research uncovers a vulnerability in someone else's product or network, coordinate disclosure with the owner and allow a reasonable amount of time for remediation before publishing technical details.
- Supports IPv4 over Ethernet only
- Operates only within the Layer 2 segment of the selected interface
- Generated MAC addresses change after each process restart
- Provides no built-in range limits, network-type checks, or automatic emergency shutdown
- Is not a defensive or address-reservation solution for production use
The code is distributed under the MIT License. The license permits use and modification and includes a warranty disclaimer, but it does not override applicable laws or the requirement to obtain the network owner's permission.