Hi what is the characteristic of spoofed ARP packets? I want to know how to detect it but before that I have to know how can I call a packet a spoofed packet. I hope you can help me thank you.
If you look at the packet, there is absolutely no difference in the format of a spoofed ARP reply and a real ARP reply: they look identical.
What makes a real ARP reply real? It came from the computer which legitimately has the queried IP address.
What makes a fake ARP reply fake? It came from a different computer than the one which really has that IP address.
Additionally there might be proxy ARP servers, although these are rather uncommon. These reply to ARP on behalf of the computer with the IP address, but are legitimate in that they are set up for this purpose by the network adminstrators.
As you can see, the only difference is whether they are legitimate or not.
If you monitor ARP on a network, it can be very hard to differentiate between
- a computer changing its network card: a given IP address reponds to ARP with one MAC address and then a different one
- an IP address being given from one computer to another by DHCP lease change or manual reconfiguration
- two proxy ARP servers
- ARP spoof replies
You'll need extra information in order to know which is which.
In addition to jonathanjo's fine answer, there are ways to validate ARP reponses. Some switches allow you to configure DHCP snooping so that
- only authorized DHCP servers work (rogue DHCP offers are dropped)
- the snooped IP-MAC combination is constantly monitored on the switch, other combinations are dropped
Of course, MAC addresses can be spoofed, too but that is another question.
In addition to the answers given, by my own experience ARP spoofing typically uses gratitious ARP and sends comparatively many packets, in order to drown out the actual host. I've used this strategy in HA cluster failover scenarios (when the host dies above the network stack level).
The first thing I'd look for if I suspect an ARP spoofer is an unusually high frequency of ARP packages. In a trivial implementation, they might even come at regular intervals.