Mitigating ARP Poisoning Via Modified ICMP and Voting Mechanism

Abstract

Address Resolution Protocol (ARP) poisoning is a key vulnerability exploited in advanced LAN attacks, such as Denial- of-Service (DoS) and Man-in-the-Middle (MITM) attacks. The stateless nature of ARP weakens network security, especially in Ethernet environments. To detect such threats, the proposed method involves monitoring network traffic through a Central Server (CS), which then sends a trap ICMP ping packet and analyzes the response to identify malicious activity. For prevention, a voting-based mechanism is used to select a trustworthy CS. By validating and correcting <IP, MAC> pair entries in hosts' cache tables, the CS effectively mitigates ARP poisoning while preserving system performance. This technique relies on ICMP and voting, offering backward compatibility, low cost, minimal traffic overhead, and easy deployment—providing a robust solution to detect and prevent MITM-based ARP poisoning while addressing ARP’s inherent weaknesses.