6

Hi what is the characteristic of spoofed ARP packets? I want to know how to detect it but before that I have to know how can I call a packet a spoofed packet. I hope you can help me thank you.

Improve this question
1
  • 7
    If there was really a difference between a legitimate ARP reply and an illegitimate ARP reply, then OS vendors would have something to detect that. You cannot tell the difference unless you already know the MAC address of the destination, and then you would not need to use ARP.
    – Ron Maupin ♦
    Commented Oct 1, 2018 at 16:11

3 Answers 3

Reset to default
6

If you look at the packet, there is absolutely no difference in the format of a spoofed ARP reply and a real ARP reply: they look identical.

What makes a real ARP reply real? It came from the computer which legitimately has the queried IP address.

What makes a fake ARP reply fake? It came from a different computer than the one which really has that IP address.

Additionally there might be proxy ARP servers, although these are rather uncommon. These reply to ARP on behalf of the computer with the IP address, but are legitimate in that they are set up for this purpose by the network adminstrators.

As you can see, the only difference is whether they are legitimate or not.

If you monitor ARP on a network, it can be very hard to differentiate between

  • a computer changing its network card: a given IP address reponds to ARP with one MAC address and then a different one
  • an IP address being given from one computer to another by DHCP lease change or manual reconfiguration
  • two proxy ARP servers
  • ARP spoof replies

You'll need extra information in order to know which is which.

Improve this answer
0
4

In addition to jonathanjo's fine answer, there are ways to validate ARP reponses. Some switches allow you to configure DHCP snooping so that

  1. only authorized DHCP servers work (rogue DHCP offers are dropped)
  2. the snooped IP-MAC combination is constantly monitored on the switch, other combinations are dropped (known as Dynamic ARP Inspection or Dynamic ARP Protection)

Of course, MAC addresses can be spoofed, too but that is another question.

However, the very best defense against ARP-based attacks is to render them useless. Separate attacker and targets (move servers into a subnet and VLAN of their own) and don't rely on IP addresses for security.

Improve this answer
3
  • 2
    Right, there is Dynamic ARP Inspection that works with DHCP Snooping.
    – Ron Maupin ♦
    Commented Oct 1, 2018 at 17:33
  • But DHCP snooping only work on Cisco swith, right?
    – Tiffany
    Commented Oct 2, 2018 at 9:46
  • No. There are many vendors offering DHCP snooping and dynamic ARP inspection in their products.
    – Zac67 ♦
    Commented Oct 2, 2018 at 11:36
1

In addition to the answers given, by my own experience ARP spoofing typically uses gratitious ARP and sends comparatively many packets, in order to drown out the actual host. I've used this strategy in HA cluster failover scenarios (when the host dies above the network stack level).

The first thing I'd look for if I suspect an ARP spoofer is an unusually high frequency of ARP packages. In a trivial implementation, they might even come at regular intervals.

Improve this answer
1
  • Sorry sir, may i know how did you know the frequency of arp packet? Did you monitor the arp packet on the network?
    – Tiffany
    Commented Oct 2, 2018 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.