![arpspoof unknown physical layer type arpspoof unknown physical layer type](https://d5k6iufjynyu8.cloudfront.net/uploads/qyresearch-1415255083-Fiber-Optic-Sensors.jpg)
A switch will update its MAC address table with a frame's source MAC address every time a frame comes into the switch, and it will use the MAC address table to determine to which switch interface it will send the frame with the destination MAC address.
![arpspoof unknown physical layer type arpspoof unknown physical layer type](https://user-images.githubusercontent.com/49931416/57159601-ac175400-6dbc-11e9-9354-db5a32a68860.png)
Ethernet switches maintain MAC address tables (not to be confused with ARP tables) to resolve the MAC address to an interface where the MAC address was last seen. There is also something else to consider if this is a switched ethernet LAN. This could be the victim sending its own ARP request to discover the layer-2 address of another host, a gratuitous ARP, unknown unicast traffic, or unicast traffic to another host that updates it ARP table. That means that when the victim sends out any traffic that the other hosts see, they will update their ARP tables with the new information. A host will also update its ARP table from any traffic it sees on the LAN. To get or update an entry in its ARP table, a host will use ARP requests. The entries in this table usually time out, but that depends on the OS. That is where ARP (Address Resolution Protocol) comes in.ĪRP maintains a table for translating layer-3 to layer-2 addresses. In order for one host on the LAN to send traffic to another host on the LAN, the host needs to resolve the destination layer-3 address into the destination layer-2 address in order to build a frame. Layer-3 is the network, and layer-3 protocols use layer-3, e.g. Some layer-2 protocols use MAC addresses (either 48-bit or 64-bit MAC addresses), and some do not. Layer-2 is the local LAN, and all traffic on the local LAN is delivered directly from one host to another host by the LAN, e.g. You need to understand the network layers. There really isn't any such thing as IP/MAC binding they way you may think. Also, clients don't register with routers, and DHCP is gratuitous in the situation you describe because the DHCP server plays no part in the situation. What you are describing is more about network disruption than information stealing.