6

Hi what is the characteristic of spoofed ARP packets? I want to know how to detect it but before that I have to know how can I call a packet a spoofed packet. I hope you can help me thank you.

  • 7
    If there was really a difference between a legitimate ARP reply and an illegitimate ARP reply, then OS vendors would have something to detect that. You cannot tell the difference unless you already know the MAC address of the destination, and then you would not need to use ARP. – Ron Maupin Oct 1 '18 at 16:11
6

If you look at the packet, there is absolutely no difference in the format of a spoofed ARP reply and a real ARP reply: they look identical.

What makes a real ARP reply real? It came from the computer which legitimately has the queried IP address.

What makes a fake ARP reply fake? It came from a different computer than the one which really has that IP address.

Additionally there might be proxy ARP servers, although these are rather uncommon. These reply to ARP on behalf of the computer with the IP address, but are legitimate in that they are set up for this purpose by the network adminstrators.

As you can see, the only difference is whether they are legitimate or not.

If you monitor ARP on a network, it can be very hard to differentiate between

  • a computer changing its network card: a given IP address reponds to ARP with one MAC address and then a different one
  • an IP address being given from one computer to another by DHCP lease change or manual reconfiguration
  • two proxy ARP servers
  • ARP spoof replies

You'll need extra information in order to know which is which.

4

In addition to jonathanjo's fine answer, there are ways to validate ARP reponses. Some switches allow you to configure DHCP snooping so that

  1. only authorized DHCP servers work (rogue DHCP offers are dropped)
  2. the snooped IP-MAC combination is constantly monitored on the switch, other combinations are dropped

Of course, MAC addresses can be spoofed, too but that is another question.

  • 2
    Right, there is Dynamic ARP Inspection that works with DHCP Snooping. – Ron Maupin Oct 1 '18 at 17:33
  • But DHCP snooping only work on Cisco swith, right? – Tiffany Oct 2 '18 at 9:46
  • No. There are many vendors offering DHCP snooping and dynamic ARP inspection in their products. – Zac67 Oct 2 '18 at 11:36
1

In addition to the answers given, by my own experience ARP spoofing typically uses gratitious ARP and sends comparatively many packets, in order to drown out the actual host. I've used this strategy in HA cluster failover scenarios (when the host dies above the network stack level).

The first thing I'd look for if I suspect an ARP spoofer is an unusually high frequency of ARP packages. In a trivial implementation, they might even come at regular intervals.

  • Sorry sir, may i know how did you know the frequency of arp packet? Did you monitor the arp packet on the network? – Tiffany Oct 2 '18 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.