Reading the Past From ARP Logs: A Forensic Analyst's Guide to Reconstructing Network Events After the Fact
When conventional network telemetry is absent, corrupted, or deliberately erased, ARP logs and cache artifacts frequently contain the residual evidence that makes incident reconstruction possible. For forensic analysts and incident responders who know how to read them, these records can establish attack timelines, identify spoofing activity, and produce evidence chains that withstand scrutiny in post-incident reviews. This guide provides a structured framework for extracting that intelligence when everything else has failed.
Why ARP Artifacts Survive When Other Evidence Does Not
Attackers who are aware of forensic investigation techniques routinely prioritize the destruction or manipulation of high-visibility log sources: firewall logs, authentication records, endpoint detection alerts. These sources are well-known, centrally aggregated, and frequently the first thing a responder examines. Precisely because they are so visible, they are also the most likely targets for anti-forensic activity.
ARP logs and cache state occupy a different position in the evidence hierarchy. They are distributed across switches, routers, endpoint operating systems, and network monitoring infrastructure. They are rarely aggregated in a single location, and their forensic value is not widely understood outside of network security specializations. As a result, they are less frequently targeted for destruction — and when they are preserved, they often contain information that no other source can provide.
The practical implication is significant: in incidents where firewall logs have been cleared, SIEM data has been tampered with, or network flow records are simply unavailable, ARP artifacts may represent the most reliable remaining record of what occurred on the network and when.
Understanding What ARP Logs Actually Record
Before applying any analytical framework, analysts must understand the content and limitations of the data sources they are working with.
Switch ARP and MAC address tables record the association between IP addresses, MAC addresses, and switch ports at a point in time. Most managed switches maintain these tables in volatile memory, meaning the current state is lost when the device is rebooted. However, some network management platforms poll and archive switch table state at regular intervals, creating a historical record that can be queried after the fact. The fidelity of this record depends entirely on the polling frequency — a five-minute polling interval means that events occurring between polls may not be captured.
DHCP server logs are not strictly ARP artifacts, but they are indispensable for ARP forensics because they establish the ground truth of legitimate IP-to-MAC associations. Cross-referencing ARP cache entries against DHCP lease records is the primary method for identifying unauthorized or spoofed address associations. Discrepancies between the two sources are among the most reliable indicators of ARP manipulation.
Endpoint ARP cache exports provide a snapshot of the ARP table as seen by individual hosts at the time of collection. On Windows systems, this can be retrieved using arp -a; on Linux and macOS systems, equivalent commands produce comparable output. In post-incident investigations, these snapshots — if collected promptly before cache entries expire — can reveal which hosts a compromised device was communicating with and whether any of those associations were anomalous.
Network monitoring and IDS logs may contain ARP-specific alerts or packet captures that were generated during the incident window. Even in environments where ARP monitoring was not explicitly configured, broad packet capture tools may have recorded ARP traffic as part of general network telemetry.
A Framework for Identifying Spoofing Indicators
ARP spoofing leaves characteristic traces in the data sources described above. Analysts should apply the following checks systematically.
MAC address duplication across multiple IP entries. In a legitimate network environment, a single MAC address should be associated with a single IP address at any given time (with the exception of certain virtualization and load balancing configurations, which should be documented and accounted for). When ARP logs show a single MAC address appearing in association with multiple IP addresses — particularly if one of those IPs belongs to a gateway or DNS server — this is a strong indicator of spoofing activity.
IP address duplication across multiple MAC entries. The inverse pattern — a single IP address appearing in association with multiple MAC addresses across different time periods — indicates that the IP has been claimed by more than one device. This pattern is characteristic of ARP cache poisoning, where an attacker broadcasts fraudulent ARP replies to replace a legitimate IP-to-MAC mapping with one pointing to the attacker's hardware address.
Rapid ARP cache state changes. ARP cache entries have defined lifetimes, and under normal conditions they change relatively infrequently for stable network resources like gateways and servers. Logs that show gateway IP-to-MAC associations changing multiple times within a short window — particularly during off-hours or outside of known maintenance periods — warrant immediate scrutiny.
ARP replies without corresponding requests. Gratuitous ARP frames — unsolicited ARP replies that update cache entries without a preceding request — are a normal part of network operation in some contexts, such as failover events. However, a pattern of gratuitous ARP frames originating from an unexpected source, or targeting high-value IP addresses like default gateways, is a recognized spoofing indicator.
Reconstructing Attack Timelines From ARP Evidence
Once spoofing indicators have been identified, the next analytical task is establishing a timeline that sequences the relevant events and places them in the context of the broader incident.
Begin by anchoring the timeline to the earliest evidence of anomalous ARP behavior. If switch table polling logs show a gateway MAC address change at a specific timestamp, that timestamp becomes a reference point. Work backward from that reference to identify any preceding events — unusual DHCP activity, new device appearances on the network, authentication anomalies — that may indicate how the attacker established a position on the network segment before initiating the spoofing activity.
Work forward from the anomalous ARP event to identify what traffic may have been intercepted. If the spoofed IP address belongs to a gateway, any traffic that transited the network during the period when the fraudulent ARP mapping was active may have been routed through the attacker's device. Correlating this window with authentication logs, file access records, and application session data can help establish what information was exposed.
Document the duration of the anomalous state. The length of time between the first appearance of a fraudulent ARP mapping and its resolution — whether through cache expiration, administrative intervention, or device reboot — is relevant both for assessing the scope of potential data exposure and for understanding attacker behavior.
Building Evidence Chains That Hold Up in Post-Incident Reviews
Forensic findings are only as useful as their ability to withstand scrutiny. ARP-based evidence chains must be documented with sufficient rigor to support post-incident review, regulatory reporting, and — in the most serious cases — legal proceedings.
Each piece of ARP evidence should be documented with its source, the method used to collect it, the timestamp of collection, and the chain of custody from collection to analysis. Raw log data should be preserved in its original form alongside any derived analysis, allowing reviewers to verify that analytical conclusions are supported by the underlying records.
Alternative explanations for anomalous ARP behavior should be explicitly considered and documented. Network reconfigurations, device replacements, and virtualization events can all produce ARP patterns that resemble spoofing activity. Ruling out these explanations — or confirming that they do not account for the observed behavior — strengthens the evidentiary value of findings that do indicate malicious activity.
For security professionals developing expertise in ARP forensics, this discipline represents one of the more demanding intersections of protocol knowledge and investigative practice. The ability to reconstruct network events from ARP artifacts — particularly under the time pressure of an active incident — is a skill that formal study can introduce but only deliberate practice develops fully.
