On investigating ARP spoofing security solutions. (12th April 2010)

• Record Type: Journal Article
• Authors: Trabelsi, Zouheir; El-Hajj, Wassim
• Is Part Of: International journal of internet protocol technology. Volume 5:Number 1/2(2010)
• Page Start: 92
• Page End: 100
• Publication Date: 2010-04-12
• Subjects: intrusion detection systems -- ARP spoofing attacks -- man-in-the-middle attacks -- MiM -- denial of service -- DoS attacks -- address resolution protocol -- network security; File Transfer Protocol (Computer network protocol) -- Periodicals; Multicasting (Computer networks) -- Periodicals; 004.678
• Languages: English
• ISSNs: 1743-8209

Abstract

The address resolution protocol (ARP) has proven to work well under regular circumstances, but it was not designed to cope with malicious hosts. By performing ARP spoofing attacks, a malicious host can either impersonate another host [man-in-the-middle attack (MiM) ] and gain access to sensitive information, or perform denial of service attack (DoS) on target hosts. Several security solutions, such as high-cost LAN switches and intrusion detection or prevention systems (IDS/IPS), are currently used to detect and prevent these attacks. In this paper, we evaluate, through extensive practical experiments, how effective these security solutions are in detecting ARP spoofing. We clearly show that ARP spoofing has not been given enough attention by most common security solutions which lack efficient detection and prevention mechanisms. We then propose an optimal algorithm that is capable of detecting all various ARP spoofing attacks; especially those not detected using the current mechanisms. The suggested algorithm can be easily integrated in any available security solution with very minimal overhead.