ARP Cache Poisoning Mitigation and Forensics Investigation

Abstract

Abstract-Address Resolution Protocol (ARP) cache spoofing or poisoning is an OSI layer 2 attack that exploits the statelessness vulnerability of the protocol to make network hosts susceptible to issues such as Man in the Middle attack, host impersonation, Denial of Service (DoS) and session hijacking.In this paper, a quantitative research approach is used to propose forensic tools for capturing evidences and mitigating ARP cache poisoning. The baseline approach is adopted to validate the proposed tools. The evidences captured before attack are compared against evidences captured when the network is under attack in order to ascertain the validity of the proposed tools in capturing ARP cache spoofing evidences.To mitigate the ARP poisoning attack, the security features DHCP Snooping and Dynamic ARP Inspection (DAI) are enabled and configured on a Cisco switch. The experimentation results showed the effectiveness of the proposed mitigation technique.

Composite CAN XL-Ethernet Networks for Next-Gen Automotive and Automation Systems

“…For example, when an Ehernet/EoC frame that embeds a ARP request is heard, the sender protocol address (SPA) field is used to create an entry ⟨SA,SPA,port⟩ in the EFDB for that port. This resembles ARP snooping [22], but it is not related to security. This approach is not more vulnerable against ARP spoofing attacks than switched Ethernet: in fact, compromised nodes may impersonate other nodes by changing their MAC-48 addresses, hence corrupting the FDB also in conventional switches.…”

A Preliminary Review on Web Session Hijacking

“…[10] vi. Real-time Detection Authors in [11] proposed a real-time detection of Medium Access Control (MAC) layer attacks in wireless networks is proposed. There can be different kinds of Denial of Service (DoS) attacks observed at the MAC layer such as misbehavior and selfish attacks.…”