Scribd Logo
Upload

Welcome to Scribd!

  • 20 views

    Detecting ARP Spoofing: An Active Technique: Abstract. The Address Resolution Protocol (ARP) Due To Its Stateless

    Uploaded by

    shaahin13631363
    This document discusses an active technique for detecting ARP spoofing attacks. It begins with background on ARP spoofing and limitations of existing passive detection methods. It then proposes an active technique that injects ARP request and TCP SYN packets to probe for inconsistencies, allowing for faster, more intelligent, scalable, and reliable detection of attacks compared to passive methods.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Detecting ARP Spoofing: An Active Technique: Abstract. The Address Resolution Protocol (ARP) Due To Its Stateless

    Uploaded by

    shaahin13631363
    20 views2 pages
    This document discusses an active technique for detecting ARP spoofing attacks. It begins with background on ARP spoofing and limitations of existing passive detection methods. It then proposes an active technique that injects ARP request and TCP SYN packets to probe for inconsistencies, allowing for faster, more intelligent, scalable, and reliable detection of attacks compared to passive methods.

    Original Title

    11593980_18

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses an active technique for detecting ARP spoofing attacks. It begins with background on ARP spoofing and limitations of existing passive detection methods. It then proposes an active technique that injects ARP request and TCP SYN packets to probe for inconsistencies, allowing for faster, more intelligent, scalable, and reliable detection of attacks compared to passive methods.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    20 views2 pages

    Detecting ARP Spoofing: An Active Technique: Abstract. The Address Resolution Protocol (ARP) Due To Its Stateless

    Uploaded by

    shaahin13631363
    This document discusses an active technique for detecting ARP spoofing attacks. It begins with background on ARP spoofing and limitations of existing passive detection methods. It then proposes an active technique that injects ARP request and TCP SYN packets to probe for inconsistencies, allowing for faster, more intelligent, scalable, and reliable detection of attacks compared to passive methods.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 2

    Detecting ARP Spoofing: An Active Technique

    Vivek Ramachandran1 and Sukumar Nandi2


    1
    Cisco Systems, Inc., Bangalore India
    2
    Indian Institute of Technology, Guwahati, Assam, India

    Abstract. The Address Resolution Protocol (ARP) due to its stateless-


    ness and lack of an authentication mechanism for verifying the identity
    of the sender has a long history of being prone to spoofing attacks. ARP
    spoofing is sometimes the starting point for more sophisticated LAN
    attacks like denial of service, man in the middle and session hijacking.
    The current methods of detection use a passive approach, monitoring
    the ARP traffic and looking for inconsistencies in the Ethernet to IP ad-
    dress mapping. The main drawback of the passive approach is the time
    lag between learning and detecting spoofing. This sometimes leads to
    the attack being discovered long after it has been orchestrated. In this
    paper, we present an active technique to detect ARP spoofing. We in-
    ject ARP request and TCP SYN packets into the network to probe for
    inconsistencies. This technique is faster, intelligent, scalable and more
    reliable in detecting attacks than the passive methods. It can also addi-
    tionally detect the real mapping of MAC to IP addresses to a fair degree
    of accuracy in the event of an actual attack.

    1 Introduction
    The ARP protocol is one of the most basic but essential protocols for LAN com-
    munication. The ARP protocol is used to resolve the MAC address of a host given
    its IP address. This is done by sending an ARP request packet (broadcasted) on
    the network. The concerned host now replies back with its MAC address in an
    ARP reply packet (unicast). In some situations a host might broadcast its own
    MAC address in a special Gratuitous ARP packet. All hosts maintain an ARP
    cache where all address mappings learnt from the network (dynamic entries) or
    configured by the administrator (static entries) are kept. The dynamic entries
    age out after a fixed interval of time, which varies across operating systems.
    After the entry ages out it is deleted from the cache and if the host wants to
    communicate with the same peer, another ARP request is made. The static en-
    tries never age out. A more detailed discussion of the ARP protocol is available
    at [1].
    The ARP protocol is stateless. Hosts will cache all ARP replies sent to them
    even if they had not sent an explicit ARP request for it. Even if a previous un-
    expired dynamic ARP entry is there in the ARP cache it will be overwritten by
    a newer ARP reply packet on most operating systems. All hosts blindly cache
    the ARP replies they receive, as they have no mechanism to authenticate their
    peer. This is the root problem, which leads to ARP spoofing.

    S. Jajodia and C. Mazumdar (Eds.): ICISS 2005, LNCS 3803, pp. 239–250, 2005.
    
    c Springer-Verlag Berlin Heidelberg 2005
    240 V. Ramachandran and S. Nandi

    ARP spoofing is the process of forging ARP packets to be able to impersonate


    another host on the network. In the most general form of ARP spoofing the
    attacker sends spoofed ARP responses to the victim periodically. The period
    between the spoofed responses is much lesser than the ARP cache entry timeout
    period for the operating system running on the victim host. This will ensure that
    the victim host would never make an ARP request for the host whose address
    the attacker is impersonating. Following subsection briefly discuss the current
    detection and mitigation techniques.

    1.1 Current Mitigation and Detection Techniques


    Existing ARP spoofing detection techniques are discussed next sequentially.

    1.1.1 Secure ARP Protocol (S-ARP)


    This has been proposed as a replacement for the ARP protocol in [10]. The
    S-ARP protocol is definitely a permanent solution to ARP spoofing but the
    biggest drawback is that we will have to make changes to the network stack of
    all the hosts. This is not very scalable as going for a stack upgrade across all
    available operating systems is something both vendors and customers will not
    be happy about. As S-ARP uses Digital Signature Algorithm (DSA) we have
    the additional overhead of cryptographic calculations though the authors of the
    paper have claimed that this overhead is not significant.

    1.1.2 Static MAC Entries


    Adding static MAC addresses on every host for all other hosts will not allow
    spoofing but is not a scalable solution at all and managing all these entries is
    a full time job by itself. This can fail miserably if mobile hosts such as laptops
    are periodically introduced into the network. Also some operating systems are
    known to overwrite static ARP entries if they receive Gratuitous ARP packets
    (GARP).

    1.1.3 Kernel Based Patches


    Kernel based patches such as Anticap[11] and Antidote[12] have made an attempt
    to protect from ARP spoofing at a individual host level. Anticap[11] does not al-
    low updating of the host ARP cache by an ARP reply that carries a different MAC
    address then the one already in the cache. This unfortunately makes it drop legal
    gratuitous ARP replies as well, which is a violation to the ARP protocol specifica-
    tion [1]. Antidote [12] on receiving an ARP reply whose MAC address differs from
    the previously cached one tries to check if the previously learnt MAC is still alive. If
    the previously learnt MAC is still alive then the update is rejected and the offend-
    ing MAC address is added to a list of banned addresses.
    Both the above techniques rely on the fact that the ARP entry in the cache
    is the legitimate one. This creates a race situation between the attacker and the

    You might also like