ARP Spoofing Risk Calculator

risk = (100 − mitigation coverage) × size factor, where mitigation = 0.5·DAI + 0.25·port security + 0.15·static share + 10 if gratuitous ARP is filtered. Dynamic ARP inspection is the only control that actually stops the attack, so it carries half the mitigation weight; port security and static entries limit it, and filtering gratuitous ARP removes the easiest delivery method. The size factor scales risk with the log of host count, because a bigger broadcast domain means more machines an attacker can sit between.

ARP has no authentication at all, so a single unmanaged host on a flat VLAN can transparently intercept traffic for every other host in that VLAN — including the default gateway.

This calculator takes 6 inputs: Hosts in the broadcast domain, Ports with dynamic ARP inspection enabled, Ports with port security enabled, Static ARP entries configured, ARP cache timeout, Gratuitous ARP filtered at the access layer. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

ARP cache entries expire, typically after 4 minutes on Linux and up to 20 on Windows, and any legitimate ARP exchange overwrites the forged entry. An attacker therefore refreshes the poison roughly twice per cache lifetime, which is exactly the repetitive gratuitous ARP pattern that detection tooling looks for.