Nowadays, leading manufacturers of enterprise-grade networking devices offer the dynamic ARP inspection (DAI) feature in their Ethernet Switches to detect and prevent ARP cache poisoning attacks from malicious hosts. However, MikroTik Ethernet switches do not yet support this feature. Within MikroTik-based networks, three potential approaches exist to prevent ARP cache poisoning attacks, each with drawbacks. This paper proposes an innovative approach called Gateway-controlled ARP (GCA) to prevent ARP cache poisoning attacks on a router-on-a-stick (RoaS) network using MikroTik networking devices, where a single router performs inter-VLAN routing through one physical interface. With this approach, all Ethernet switches are configured to forward ARP messages from hosts directly to the router for inspection and handling. A RouterOS script based on the GCA approach was implemented and executed on the router to handle all incoming ARP requests from any host in all VLANs, ensuring all hosts receive legitimate ARP responses from the router. This approach can effectively prevent spoofed ARP packets sent by malicious attackers. This approach was tested and evaluated on an actual RoaS network, focusing on processing time, CPU Load, and response time. The evaluation results show that the approach effectively prevents ARP cache poisoning attacks.
Read full abstract