Identifying ARP Spoofing Through Active Strategies

Abstract

Due to its stateless nature and absence of authentication mechanisms to verify sender identity, the Address Resolution Protocol (ARP) has long been susceptible to spoofing attacks. ARP spoofing often serves as a gateway to more advanced attacks on local area networks, such as denial of service, man-in-the-middle, and session hijacking. Most existing detection methods adopt a passive approach by monitoring ARP traffic for anomalies in the IP-to-Ethernet address mappings. However, this strategy suffers from a delayed response time, often identifying an attack only after it has already caused harm. In this paper, we introduce an active detection technique for ARP spoofing. By injecting ARP request and TCP SYN packets into the network, we proactively probe for mismatches in address mappings. Compared to passive methods, our approach is faster, more intelligent, scalable, and reliable. Additionally, it enhances accuracy in identifying the true MAC-to-IP address associations during an attack scenario.