Experimental Simulation and Analysis of Layer 2 Attack Vectors: Arp/DNS Spoofing and Mitm

This report examines the security of the Data Link Layer (Layer 2) of the OSI model, focusing on fundamental vulnerabilities in core local communication protocols. It addresses the concept of "implicit trust" inherent in the design of the Address Resolution Protocol (ARP) and the Domain Name System (DNS), which enables Man-in-the-Middle (MITM) attacks. The report analyzes the theoretical mechanisms of ARP cache poisoning and DNS spoofing. Network traffic was intercepted and subjected to forensic analysis through controlled simulations in an isolated laboratory environment. Key packet-level Indicators of Compromise (IoCs) were identified, including duplicate MAC addresses, an anomalous frequency of unsolicited ARP responses (Gratuitous ARP), and unusually low DNS resolution response times. In conclusion, architectural and software-based protective measures are outlined, including the implementation of Dynamic ARP Inspection (DAI), Port Security, and encrypted DNS protocols (DoH/DoT).