A man-in-the-middle attack is a generalized concept that can be implemented in many different scenarios than a specific attack. Generally, in these attacks, a system that can view the communication between two systems imposes itself in the communication path between those other systems. Man-in-the-middle attacks are complex attacks that require successful attacks against IP routing or protocols (such as Address Resolution Protocol [ARP], neighbor discovery [ND] for IPv6, DNS, or DHCP), resulting in the misdirection of traffic.
中間人攻擊（Man-in-the-Middle Attack）是一個廣義的概念，可以在許多不同的情境下實現，而不是單一特定的攻擊方式。一般來說，在這類攻擊中，能夠檢視兩個系統之間通訊的系統，會將自己置入這些系統之間的通訊路徑中。中間人攻擊是複雜的攻擊，需要成功攻擊 IP 路由或通訊協定（例如位址解析協定〔ARP〕、IPv6 的鄰居探索〔ND〕、DNS 或 DHCP），以造成流量被誤導。
For example, an ARP-based man-in-the-middle attack is achieved when an attacker poisons the ARP cache of two devices with the MAC address of the attacker's network interface card (NIC). Once the ARP caches have been successfully poisoned, each victim device sends all its packets to the attacker when communicating to the other device. The attacker is put in the middle of the communications path between the two victim devices. It allows an attacker to monitor all communication between victim devices easily. The intent is to intercept and view the information being passed between the two victim devices and potentially introduce sessions and traffic between the two victim devices.
舉例來說，以 ARP 為基礎的中間人攻擊，是攻擊者用自己網路介面卡（NIC）的 MAC 位址，去毒害兩台裝置的 ARP 快取而達成的。一旦 ARP 快取成功遭到毒害，每台受害裝置在與另一台裝置通訊時，都會把所有封包送給攻擊者。攻擊者因此被置於兩台受害裝置之間的通訊路徑中，讓攻擊者能輕易監控受害裝置之間的所有通訊。其目的是攔截並檢視在兩台受害裝置之間傳遞的資訊，並有可能在兩台受害裝置之間植入新的工作階段與流量。
The figure illustrates an ARP-based man-in-the-middle attack.
下圖說明以 ARP 為基礎的中間人攻擊。
The attacker poisons the ARP caches of hosts A and B so that each host will send all its packets to the attacker when communicating to the other host.
攻擊者毒害了主機 A 與主機 B 的 ARP 快取，使兩台主機在與對方通訊時，都會把所有封包送給攻擊者。
A man-in-the-middle attack can be passive or active. In passive attacks, attackers steal confidential information. In active attacks, attackers modify data in transit or inject data of their own. ARP cache poisoning attacks often target a host and the host’s default gateway. The attacker is put as a man-in-the-middle between the host and all other systems outside of the local subnet.
中間人攻擊可以是被動的，也可以是主動的。在被動攻擊中，攻擊者竊取機密資訊；在主動攻擊中，攻擊者修改傳輸中的資料，或植入自己的資料。ARP 快取毒化攻擊經常鎖定主機及其預設閘道為目標。攻擊者被置於主機與本地子網路以外所有其他系統之間，扮演中間人的角色。
Today, there are many standard approaches and best practices to protect against man-in-the-middle attacks. Strong cryptography in combination with a fully verified trust chain belongs to the best.
如今已有許多標準做法與最佳實務可用來防範中間人攻擊，其中最好的方法之一，就是結合強加密與經過完整驗證的信任鏈。