ARP Modification for Prevention of IP Spoofing

Abstract

The address resolution protocol (ARP) provides dynamic mapping between two different forms of addresses: the 32-bit Internet protocol (IP) address of the network layer and the 48-bit medium access control (MAC) address of the data link layer. A host computer finds the MAC address of the default gateway or the other hosts on the same subnet by using ARP and can then send IP packets. However, ARP can be used for network attacks, which are one of the most prevalent types of network attacks today. In this study, a new ARP algorithm that can prevent IP spoofing attacks is proposed. The proposed ARP algorithm is a broadcast ARP reply and an ARP notification. The broadcast ARP reply was used for checking whether the ARP information was forged. The broadcast ARP notification was used for preventing a normal host's ARP table from being poisoned. The proposed algorithm is backward compatible with the current ARP protocol and dynamically prevents any ARP spoofing attacks. In this study, the proposed ARP algorithm was implemented on the Linux operating system; here, we present the test results with respect to the prevention of ARP spoofing attacks.

A study on the Kismet-based wireless intrusion prevention system

“…The security vulnerability of IEEE 802.1x is the weakness of brute force and MITM (man in the middle attack). These causes are due to the vulnerable issues with EAP And WEP [4,5].…”

Address resolution protocol spoofing attacks and security approaches: A survey

“…Address resolution protocol (ARP) is one of the important protocols in Transmission Control Protocol (TCP)/Internet protocol (IP) and is used to associate the IP address of the network layer to the MAC address of the data link layer , , , , , , . Using this protocol can identify how many hosts are connected in the LAN, and discover the MAC address to IP address, in an LAN environment .…”