Uploaded December 2021 | Updated September 2026, 2 hours ago

---

In this video, we look deeper into a man in the middle ARP poison attack, showing how to quickly filter for it in Wireshark.

For your reference, the filter that I show you how to build in the video is this one:
((arp.src.proto_ipv4 == 10.0.0.1) && (arp.opcode == 2)) && !(arp.src.hw_mac == 11:22:33:44:55:66)

Just replace your local gateway IP and MAC address and you can use this filter to spot MiTM attacks that are posing as your gateway.

Also check out the first video in this series on how an ARP attack works.
youtu.be/cVTUeEoJgEg

Please comment below if you like this content, let me know what you think!

== More On-Demand Training from Chris ==
▶Getting Started with Wireshark - bit.ly/udemywireshark
▶Getting Started with Nmap - bit.ly/udemynmap

== Live Wireshark Training ==
▶TCP/IP Deep Dive Analysis with Wireshark - bit.ly/virtualwireshark

== Private Wireshark Training ==
Let's get in touch - packetpioneer.com/product/private-virtual-classroom

Chapters:
0:00 Intro
0:44 Capturing the MiTM Attack
1:45 Analyzing the ARP Attack
2:06 Wireshark Expert Flag
2:50 Filtering for an ARP Poison Attack
5:50 How this filter works