A framework to mitigate ARP sniffing attacks by cache poisoning. (2018)

• Record Type: Journal Article
• Authors: Prabadevi, B.; Jeyanthi, N.
• Is Part Of: International journal of advanced intelligence paradigms. Volume 10:Number 1/2(2018)
• Page Start: 146
• Page End: 159
• Publication Date: 2018
• Subjects: ARP cache poisoning -- address resolution -- man-in-the-middle attacks -- host impersonation -- mitigation -- ARP sniffing attacks -- DDoS attacks; Artificial intelligence -- Periodicals; Machine theory -- Periodicals; Fuzzy logic -- Periodicals; 006.305
• Languages: English
• ISSNs: 1755-0386

Abstract

Today in the digital era of computing, most of the network attacks are caused by sniffing the sensitive data over the network. Among various types of sniffing attacks, ARP sniffing causes most of the LAN attacks (wired and wireless LAN coexist). ARP sniffing causes poisoning of ARP cache or spoofing. Through ARP sniffing, the attacker tries to know the (IP, MAC) pair of victim's system available in ARP table or ARP request-reply packet passed over the network and either exploits victim's resources or creates a situation to deny victim's services for its legitimate users. This in-turn causes MITM, DoS or DDoS attacks. The major cause for these attacks is lack of effective authentication mechanisms with ARP or RARP protocols used for address resolution. This paper provides the working principle of ARP protocol and a method to mitigate the attacks caused by ARP cache poisoning. The proposed framework compares the IP-MAC pair in the ARP and Ethernet headers and if any fake entry is suspected, the information is updated in the fake list and a message is sent to the gateway or router to alert it from cache poisoning attacks.