L3 - ARPSec – A Secure Openflow Network Controller Module to control and protect the Address Resolution Protocol

Abstract

The Address Resolution Protocol (ARP) is used to map IP addresses to MAC addresses in local area networks. This protocol has some security vulnerabilities and one of them is the Man-in-the-Middle (MITM) attack. Software-Defined Networks (SDNs) represent an innovative approach in the area of computer networks, since they propose a new model to control forwarding and routing data packets that navigate the Internet. This paper presents the module L3-ARPSec, a set of instructions written in the Python programming language that proposes a way to control the switching of ARP messages and also mitigates the MITM attack in local area networks.

Mitigating ARP Cache Poisoning Attack in Software-Defined Networking (SDN): A Survey

“…L3-ARPSEC [31] is another IP-MAC address binding based solution. This solution also runs a module on the Controller.…”

“…If this average value is less than 3 s, it assumes that an attack is being attempted, as it is unusual to see so many ARP reply packets in short span of 3 s. The switch is then directed by the Controller to block packets from the attacker. Authors in [31] are of the view that attacker can send many ARP reply packets in fraction of seconds and they may be difficult to detect. Therefore, unlike other IP-MAC binding based solutions, L3-ARPSEC scans the IP and MAC bindings table every 13 s to find entries that have different IP addresses but same MAC addresses.…”

“…This enables L3-ARPSEC to detect and block the attacker. Simulations with three hosts and one switch in Mininet were carried out by the authors in [31]. The results show that L3-ARPSEC can effectively detect and block the attacker.…”

“…Firstly, it is not clear how to create the IP-MAC bindings table in the beginning as ARP packets sent initially could already be spoofed. Additionally, some solutions [30,31,34] in this category build the IP-MAC bindings based on the DHCP messages in the network. However, this way of building the table is not effective in mitigating the ARP Cache Poisoning Attack.…”

“…Critical evaluation of all the solutions show that Controller plays a significant role in implementing most of the solutions, e.g., running applications that maintain IP-MAC address bindings [21,[30][31][32][33][34], running applications that analyze all ARP packets [12,23,24] etc. However, it should be noted that the Controller is the brain of the network and performs many other tasks.…”