The victim and the attacker sit on the same switched segment. Step through each scenario and watch two things only: the victim's ARP cache, and the address fields the sender wrote into the packet.
Victim ARP cache
Address
Resolves to
192.168.1.1
00-1a-2b-3c-4d-5e
192.168.1.102
00-a0-d2-14-a2-11
18.7.22.59
off LAN, no entry
Address fields on the wire
Field
Value asserted
source MAC
-
dest MAC
-
source IP
-
dest IP
-
Step 0
Choose a scenario, then press next step.
Arrow keys also work
What to take from this scenario
Why perimeter controls do not help
All of the LAN traffic above passes between two hosts on the same switch. It never crosses the router, so the firewall and NAT translation on the WAN interface never inspect it. The attacker is already inside the trust boundary, which is why the controls that matter here live on the switch and in the application:
Switch port security, limiting which MAC addresses may appear on a port.
Dynamic ARP inspection, which validates ARP messages on untrusted ports against DHCP snooping bindings. This is the fourth scenario above.
Segmentation and private VLANs, so that hosts that never need to talk to each other cannot.
Authentication that does not rely on addresses at all: TLS with certificate validation, mutual authentication, signed messages. This is the only measure that survives an attacker who already owns the path.