LANjacking refers to the unauthorized interception, manipulation, or redirection of traffic within a local area network, typically happening on shared or flat Layer 2 environments where hosts can see each other’s Ethernet frames. In office buildings, multi-tenant units, university dormitories, and co-working spaces, devices that are not properly isolated allow an on-path attacker to capture usernames, passwords, session cookies, and other data that is not encrypted in transit. This overview explains the mechanics of LANjacking, why certain network designs make it easier, how to detect it, and concrete configurations and controls that materially reduce the risk over time.
How LANjacking works at the Ethernet and ARP layer
At the data link layer, each network interface has a Media Access Control (MAC) address burned into its hardware. Switches learn which port leads to which MAC by inspecting the source address of every frame they receive, building a MAC address table. When a host wants to send a frame to another host on the same network, it first checks its Address Resolution Protocol (ARP) cache for the destination IP-to-MAC mapping. If no entry exists, the host broadcasts an ARP request, and the intended recipient replies with its MAC address. An attacker on the same broadcast domain can watch these ARP exchanges, inject spoofed replies, and trick other hosts into sending traffic to the attacker’s MAC, a classic man-in-the-middle technique that sits at the core of many LANjacking scenarios.
Promiscuous mode and packet visibility
By default, a host’s network adapter filters out frames that are not addressed to its own MAC, to its own multicast group, or to broadcast. When an interface is placed in promiscuous mode, it accepts all frames that pass across the wire, enabling packet capture tools and intrusion detection systems to inspect traffic belonging to other hosts. On modern switched Ethernet, promiscuous mode alone is often insufficient, but combined with ARP spoofing or exploitation of misconfigured Layer 2 devices, an attacker can make a host accept frames not destined to it, effectively enabling LANjacking without requiring physical tap points.
Common LANjacking methods and techniques
LANjacking is less a single exploit and more a category of on-path attacks that abuse flat network designs, weak access controls, or implementation quirks. Understanding the specific methods helps prioritize defenses and measure where risk is highest in a given environment.
ARP spoofing and poisoning
The Address Resolution Protocol was designed for simplicity and trust, with no built-in authentication. An attacker can send unsolicited ARP replies that associate the attacker’s MAC with the IP address of a gateway or another host. When hosts update their ARP caches, their traffic is forwarded to the attacker, who may forward it onward (man-in-the-middle) or drop it (man-in-the-middle with denial). Over time, associations may time out and reappear, so these attacks are often iterative rather than a one-time event.
MAC flooding and CAM table exhaustion
Each Ethernet switch contains a Content Addressable Memory (CAM) table that maps MAC addresses to ports. Many low-cost or misconfigured switches have a limit on the number of MAC entries. By flooding the switch with frames that contain random source MAC addresses, an attacker can fill the CAM table, causing the switch to fail open and act like a hub, broadcasting frames to all ports. Once the CAM is saturated, the attacker can capture traffic that would normally be unicast between two specific hosts.
DHCP starvation and rogue servers
Dynamic Host Configuration Protocol assigns IP addresses and network options to clients. Through DHCP starvation, an attacker rapidly requests all available addresses from a legitimate DHCP server, preventing legitimate devices from obtaining addresses. Meanwhile, an attacker can offer IP configurations as a rogue DHCP server, pointing clients to malicious routers or DNS resolvers. These tactics enable on-path interception and can persist across reboots until the attack is detected and stopped.
Measurable impact and realistic risk assessment
The practical risk from LANjacking depends on network architecture, device configurations, and the presence of higher-layer protections such as encryption and authentication. In a flat office network with hundreds of endpoints and limited segmentation, the likelihood of successful interception is materially higher than in a modern environment with host-based controls, port security, and encryption everywhere. Below is a concise comparison of factors that correlate with risk and the kinds of data that could be exposed when controls are weak.
| Attribute | Measurable Risk Indicator | Source Type |
|---|---|---|
| Network topology (flat vs segmented) | Flat networks increase exposure; VLANs reduce broadcast reach | Architecture measurement |
| Switch CAM table size | Small tables are easier to exhaust; vendor and model data | Device specs |
| Use of encryption in transit (TLS, VPN) | High encryption coverage greatly reduces practical impact | Configuration audit |
| ARP spoofing detection controls | Unmonitored environments show higher incident rates | Monitoring logs |
| Port security and MAC limiting | Ports that allow one or few MACs lower attack surface | Policy audit |
Detection and monitoring for LANjacking
Because LANjacking abuses normal Layer 2 behavior, detection starts with baselines and anomaly detection at multiple levels. On hosts, unexpected changes in gateway MAC addresses, frequent ARP cache entries, and unusual duplicate IP addresses can indicate active spoofing. On the network side, switches can generate logs when new MAC addresses appear on ports, when CAM table usage nears capacity, or when a port receives more frames than a host could reasonably generate. NetFlow or IPFIX exports can also reveal traffic patterns consistent on-path interception, such as asymmetric flows or hosts communicating through an unexpected next hop. Security teams should correlate these signals with vulnerability findings to prioritize fixes.
Practical defenses and hardening checklist
Reducing LANjacking risk is largely a matter of design, configuration, and routine verification. The most meaningful controls address the root causes: unnecessary shared media, missing authentication at Layer 2, and missing encryption. A focused checklist can guide both immediate actions and longer-term architecture improvements.
Actionable steps to reduce LANjacking risk
- Segment networks with VLANs and strictly limit inter-VLAN routing to approved paths.
- Enable switch features such as Dynamic ARP Inspection (DAI) and DHCP Snooping to drop forged replies and unauthorized DHCP responses.
- Implement port security on access switches to limit the number of allowed MAC addresses per port.
- Disable unused ports and place them in an unused VLAN; enable errdisable on violations.
- Ensure critical services use TLS with strong ciphers and certificate verification; prefer VPNs for remote access.
- Monitor ARP tables and CAM utilization with threshold alerts and integrate logs into a SIEM or monitoring platform.
- Use host-based integrity monitoring and, where feasible, encrypted DNS to reduce poisoning leverage.
Limitations of defense-in-depth and ongoing maintenance
No set of controls can eliminate every risk in a complex environment, and controls themselves can degrade through configuration drift, software updates, and device failures. Dynamic ARP Inspection and similar features depend on careful synchronization across switches and may break legacy applications if deployed too aggressively. Port security must be balanced with legitimate needs such as high availability devices that connect through multiple ports. Regular audits, including network diagrams, switch configurations, and vulnerability scans, help ensure that intended controls remain effective as environments evolve. Treat LANjacking defenses as one component of a broader secure network strategy rather than a standalone fix.
When to suspect LANjacking and next steps
If you observe repeated unexplained man-in-the-middle behavior, inconsistent ARP entries, or sudden patterns of CAM table saturation, consider LANjacking as one plausible cause and begin methodical investigation. Start by capturing and correlating logs from endpoints, switches, and any existing monitoring systems. Run controlled tests, such as controlled ARP spoofing from a designated host, to verify whether the network responds as expected. Engage security professionals for deeper forensic work if internal capacity is limited, and use findings to drive configuration changes, architecture improvements, and updated playbooks. Document lessons learned so that detections and controls improve over time rather than repeating the same mistakes.
Bottom line
LANjacking is a practical on-path threat that thrives on flat, poorly monitored Layer 2 environments and weak port configurations. Its mechanics are well understood, its measurable impact can be reduced with proper segmentation and switch features, and its detection relies on coordinated host and network telemetry. By implementing targeted hardening steps—VLAN segmentation, Dynamic ARP Inspection, port security, encryption, and continuous monitoring—you materially lower risk and increase visibility into attacks that depend on listening in on local network traffic.