Mitigating ARP Spoofing Attacks in Software-Defined Networks

Abstract

Software-Defined Networks (SDN) are emerging as an attractive solution to overcome the limitations of traditional networks. They provide network programmability and promote rapid innovation in protocol design, network management and network security. Today, network security is the most important concern for any computer network administrator. Traditional networks had several security problems, some of them no longer exist with the advent of SDN and others still do exist. ARP spoofing or ARP cache-poisoning attack is mainly seen in LAN networks, which has no efficient solution to mitigate in traditional networks but SDN provides a unique way to solve this problem without any changes in the network. ARP spoofing is exploited in different forms, mainly request and reply based attacks. In this paper, a solution is proposed to mitigate both of these types of ARP attacks in Software defined networks. The proposed solution extends the SDN controller to include an ARP module, which detects and stops the attack, and avoids overloading or Denial of Service on the controller. The solution is fast, reliable and tested for different attack scenarios. Openflow is used for the communication between the controller and switches, emulated by Mininet.