Lab Guide · MITM & Layer 2 Defense Sandbox

0% · 0/16 steps

MITM & Layer 2 Defense Sandbox — Lab Guide

An interactive lab on how a Man-in-the-Middle attack is launched with ARP poisoning, and how Layer 2 controls detect, contain and mitigate it.

Work top to bottom: load a preset, run it in the simulator, tick each step as you complete it, then answer the CISO questions at the end.

Architecture Diagram

                 ┌──────────────┐
   Victim  ──1───┤              ├──24──  Router
 10.0.1.10       │   L2 SWITCH  │       10.0.1.1
                 │              │
 Attacker ──2────┤              │
 10.0.1.99       └──────┬───────┘
                        │
                 NAC / RADIUS (802.1X)

Node	Role	IP	MAC	Port / VLAN
1	Victim workstation	`10.0.1.10`	`00:11:22:33:44:10`	Gi0/1 · VLAN 10
2	Managed L2 switch	—	—	Gi0/1, Gi0/2, Gi0/24
3	Attacker device	`10.0.1.99`	`DE:AD:BE:EF:99:99`	Gi0/2 · VLAN 10
4	Gateway router	`10.0.1.1`	`00:00:0C:07:AC:01`	Gi0/24
5	NAC controller	—	—	RADIUS / 802.1X

Exercise 1 — Legitimate ARP Baseline

Establish the known-good state every defense is measured against.

✓ Exercise 1 · Clean baseline loaded into the simulator

Load the Exercise 1 preset and confirm every defense toggle is off.Click Run selected scenario and watch the ARP request broadcast from the victim.Open View Victim ARP Table and confirm 10.0.1.1 → 00:00:0C:07:AC:01 is dynamic and clean.Confirm the Interception Engine reports poisoning mode NONE and IP forwarding DISABLED.

Exercise 2 — Bidirectional ARP Poisoning & MITM

The attacker sends two unsolicited ARP replies at once and becomes a transparent proxy.

✓ Exercise 2 · Symmetric MITM loaded into the simulator

Load the Exercise 2 preset, then click Trigger ARP Poisoning.Verify the victim cache shows 10.0.1.1 → DE:AD:BE:EF:99:99 (rogue).Verify the router cache shows 10.0.1.10 → DE:AD:BE:EF:99:99 (rogue).Click Send Intercepted HTTP Traffic and trace the 4-hop relay in the topology.Read the Interception Engine: note L2 addresses point at the attacker while L3 is untouched.

[ARP]   10.0.1.1 is at DE:AD:BE:EF:99:99   ← POISONED
[MITM]  Symmetric flow established — relaying victim ↔ router

Exercise 3 — Layer 2 Defenses

Break the attack chain with port security, DAI and NAC.

✓ Exercise 3 · DAI + DHCP snooping loaded into the simulator

Enable Port Security + Sticky MAC on Gi0/24 and try each violation action.Note what port security does not prevent (poisoning on the access port).Load the DAI preset, re-trigger poisoning, and confirm both ARP caches stay clean.Read the [DAI] Invalid ARP reply on Gi0/2 — dropped log line.

✓ Exercise 3 · NAC enforcement loaded into the simulator

Run the rogue device scenario with NAC enforcing.Compare hard block, isolation VLAN 666 and guest VLAN 99 outcomes.Confirm Gi0/2 flips from UNAUTHENTICATED to REMEDIATED.

CISO Analysis Questions

Answers are saved locally in this browser as you type.

Why does ARP poisoning succeed even on a fully patched network? What trust assumption is being abused?

Port security was enabled on the uplink but the attack still worked. Explain the gap and which control actually closes it.

You can only fund one control this quarter: DAI or 802.1X NAC. Justify your choice in risk terms.

Which log entries would you forward to the SIEM, and what detection rule would you write around them?

Key Takeaways

Control	Attack vector it solves	Layer
Port Security	Unauthorized MAC on an access port	L2
DHCP Snooping + DAI	Forged ARP replies / ARP poisoning	L2
NAC / 802.1X	Unauthorized device joining the network	L2 + AuthN

ARP poisoning is powerful because it needs no physical access or stolen password — and fragile because it only works where the network blindly trusts ARP.