Prevention of ARP spoofing: A probe packet based technique

Abstract

In today's competitive world consideration of maintaining the security of information is must. Nowadays LAN is generally the most common and popular network domain. Network domains are always prone to number of network attacks. One of the most dangerous form of such network attacks is ARP Cache Poisoning also known as ARP Spoofing. ARP is a stateless protocol and ARP Spoofing takes place mainly because it lacks any mechanism of verifying the identity of sending host. It has been seen that most of the LAN attacks results from ARP Spoofing. So prevention, detection and mitigation of this problem can stop number of network attacks. ARP Spoofing is the act of vindictively changing the IP,MAC associations stored in ARP cache of any network host. In this paper we have proposed a probe based technique with an Enhanced Spoof Detection Engine (E- SDE) which not only detects ARP Spoofing but also identifies the genuine IP,MAC association. ARP and ICMP packets have been used as probe packets. Working of E-SDE is explained with the help of algorithm. We have also proposed an attacking model to clearly understand the incremental development of E-SDE to work effectively against most of the type of attackers. We have also measured the network traffic added by the proposed technique.