ARP poisoning
L2 attack: attacker on same LAN sends fake ARP responses → victim's ARP cache maps gateway IP to attacker's MAC. All victim's outbound traffic passes attacker → MITM possibility.
Tools: Ettercap, Bettercap, arpspoof. Standard Kali Linux + pentest curriculum. Works until victim reboots or ARP cache timeout (5-20 min). Defense: DAI (Dynamic ARP Inspection) on switch — validates ARP against DHCP snooping binding table, drops invalid ARP. Static ARP entries for critical hosts (servers, gateways). Modern relevance: WiFi → cell data or VPN bypasses LAN attacker, but corp LAN is still vulnerable. HTTPS protects data confidentiality but MITM can do DoS or traffic analysis.