1

Among all techniques proposed to detect MAC spoofing, is there a reliable and decentralized approach such that we can detect this type of attack strongly?

Some of proposed approaches are as follows:

https://www.cs.dartmouth.edu/~campbell/papers/spoofing.pdf

https://pdfs.semanticscholar.org/d5ef/30919b4f28b82d6fb637e17a5a992f82ecaa.pdf

https://ieeexplore.ieee.org/abstract/document/5723112/

And more approaches: https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=mac++spoofing+detection&btnG=

We hear too much that MAC spoofing is very simple. Does it mean that non of those approaches for detecting MAC spoofing does not work? And in general, does it mean that there is no way to detect MAC spoofing?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 25, 2018 at 9:56

2 Answers 2

Reset to default
4

Generally, there is no way to prevent a user changing his node's MAC address. You're left with detecting MAC spoofing.

On wired networks you may want to enforce strict MAC-port association - you only accept a given MAC on its assigned port and on a given port you only accepted the assigned MAC. I'll also want to watch link states very closely - after a link down/up event occured you can't trust the MAC on that link any more, the node may have been replaced with a spoofing node.

A common approach to authenticate links before admitting them to the network is 802.1X port authentication. However, 802.1X has many attack vectors and there are numerous extensions for preventing that - or rather, make it harder.

On wireless networks you use 802.1X authentication by default, so you know who's gaining access. The MAC address is pretty much useless for security here since anyone can use any address. Of course, you can monitor a node's geographic location through the radio parameters, but this isn't possible with a mobile node.

Fingerprinting a node (through its OS/stack) helps to raise the bar but isn't 100% reliable - an attacker could spoof that as well.

What you're left with - depending on the security level you really require - is a cryptographic approach with a PKI or centrally managed keys.

Improve this answer
5
  • Thank you, could please give some links/doc about "Fingerprinting a node" ? I'd like to know more about that to know if it is possible to do this approach with a "decentralized" manner? Thanks
    – Questioner
    Nov 11, 2018 at 11:35
  • 1
    The "Sequence Number-Based MAC Address Spoof Detection" paper you linked to is a fingerprinting approach.
    – Zac67 ♦
    Nov 11, 2018 at 11:40
  • Thank you, and in your opinion it is possible to do this approach in a decentralized manner ? or we need a trusted entity? Thanks
    – Questioner
    Nov 11, 2018 at 11:43
  • Meanwhile, this paper apparently is for WLANs that as you mentioned are more vulnerable to MAC spoofing, Is there a reliable approach for wired networks? As you said, maybe "802.1X port authentication", but is it done only "centrally"? Thanks again
    – Questioner
    Nov 11, 2018 at 11:52
  • 2
    802.1X requires control on the port level - it's implemented on a switch as authenticator and uses a RADIUS server or some other central authentication.
    – Zac67 ♦
    Nov 11, 2018 at 12:39
4

On cisco devices you can use DHCP Snooping, dynamic arp inspection and ip source guard. Which basically keeps a databases of what ip is assigned to what devices having what mac addresses. So later if an end user changes his mac address it will be detected, this works if they keep their old ip address.

But as Zac67 said, you can use 802.1x to control who have access to your network in first place by authenticating the user. This will make sure that you authenticate the user before authenticating their device.

Or you can manually define what Mac address is allowed on a certain port.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/dot1x.html

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/dynarp.html

Improve this answer
8
  • Thank you, but I am looking for a "decentralized" manner to "detect (and not necessarily prevent)" MAC spoofing. Do you think is there a decentralized approach? Thanks
    – Questioner
    Nov 11, 2018 at 16:57
  • 2
    Configuring this on the switch a device is connected to is decentralized.
    – Teun Vink ♦
    Nov 11, 2018 at 19:45
  • 1
    Maybe this will help: ncbi.nlm.nih.gov/pmc/articles/PMC4813856
    – Muhammad Nasir Akram
    Nov 11, 2018 at 20:10
  • 2
    The point various people have been making over various posts by you now, but which does not seem to land, is that port security is a local solution. It runs on the switch a device is connected to. It's controlled by whoever operates the switch. There's no "global" switch configuration. It's obvious from other questions what you're trying to achieve and as other pointed out over and over again now, it will not work as you think. Please put some time into reading into what port security actually is and how it works, we're running around in circles as it is.
    – Teun Vink ♦
    Nov 12, 2018 at 10:46
  • 1
    I think many people have said 'no' enough times now, but you seem to persist on this idea. MAC spoofing is a local problem which can only be solved locally in networks.
    – Teun Vink ♦
    Nov 12, 2018 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.