A server, gateway, or IP telephone needs the Media Access Control (MAC) address of the target networked device in order to communicate with that device. And vice-versa, any device that tries to communicate with an Avaya server, gateway, or IP telephone needs the MAC address of the server/gateway/IP telephone. When the MAC address is not yet known, an Address Resolution Protocol (ARP) request is sent to a known IP address to determine what the MAC address is. For example, Device A initiates communication with Device B by sending an Address Resolution Protocol (ARP) request along with the IP address of device B. Device B then replies to device A and sends device B’s MAC address. Device A then updates its ARP cache to save the MAC address for any future communications with the device B.
An attacker uses an ARP spoofing tool to identify the IP and MAC addresses of the device (server, gateway, or IP telephone) to be attacked. Since the initiating device sends an ARP request as a broadcast, the attacker’s ARP- spoofing tool can listen for these requests. Once the spoofing tool has an IP address for Device A and Device B, it can send fake ARP replies to each device. Each device then changes the ARP cache for that device such that Device A has the MAC address of the attacker’s host instead of Device B’s MAC address, and Device B has the MAC address of the attacker’s host instead of Device A’s MAC address. This impersonation causes IP traffic between the target devices and other locales to be routed through the attacker’s host. With sniffing tools, the attacker can then eavesdrop on calls and sniff the packets for other data such as user names, logins, and passwords. This rerouting and manipulations of data is called a "man-in-the-middle" attack.