1

I want to know if I'm protected for ARP spoofing.

In my network, all PCs, printers, phones and servers are in distinct VLANs. I got a layer 3 switch for servers, which handles routing between these VLANs, and layer 2 switches for connecting PCs, printers and phones. I use DHCP snooping to be sure that only my DHCP server is giving IP addresses. I have an internet gateway in the same VLAN used for servers. I don't have any specific configuration for ARP on the layer 2 and 3 switches.

Since ARP is blocked by routers, am I open or not to ARP spoofing?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 16, 2017 at 21:56

2 Answers 2

Reset to default
1

ARP spoofing only works on a LAN, not across LANs, so you are safe from ARP spoofing from outside a LAN. Unfortunately, most successful attacks happen from within a network. For example, a host on your network could be compromised (look at other SE sites to see the large quantity of questions from workers looking to bypass a company's network security to be able to play games or stream videos). Since you are running DHCP snooping, you could add DAI (Dynamic ARP Inspection) to prevent ARP spoofing on a LAN.

Improve this answer
4
  • thanks for your response. yes i'm talking specifically for this on the LAN. all arp spoofing scenarios i have found are done in the same vlan. is it possible for a host in a vlan to spoof a host from another vlan ? i don't care if a worker spoof another worker, they all have same permissions, but i care if a worker can spoof a server.
    – user34224
    Feb 7, 2017 at 2:45
  • ARP uses a LAN broadcast, and the broadcast cannot cross a router because a router strips off the layer-2 frame from a packet. What I meant was that an outsider could get control over one of your computers to which a worker created a backdoor. That is how target lost many millions of dollars.
    – Ron Maupin ♦
    Feb 7, 2017 at 2:48
  • so what i understand is : 1) servers are protected because of the use of VLANs, 2) PCs VLAN is unprotected (2 hosts can be hijacked by an attacker), but since there is not host-2-host traffic i don't care, 3) an attacker can spoof the gateway IP address and decrypt all traffic from/to this VLAN, so layer 2 switchs need to be secured with a static arp entry for the gateway, 4) use arp limit to prevent DoS. Of course this is not perfect, but it's a start.
    – user34224
    Feb 7, 2017 at 15:35
  • DAI will cover most things for you. It requires DHCP snooping that you already run. ARP spoofing is really about disrupting a network, not so much about stealing information. DAI can make sure that the ARP address in use belongs to the device on that interface.
    – Ron Maupin ♦
    Feb 7, 2017 at 15:39
0

Look for the insider attacks ,ARP spoofing dont work outside the LAN. Routers are never effected by ARP spoofing or poisoning as they work on layer 3.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.