Detecting ARP Poisoning in Network Traffic

Overview

ARP poisoning (ARP spoofing) is a Layer 2 attack where an adversary sends falsified ARP messages to associate their MAC address with the IP address of a legitimate host, enabling man-in-the-middle (MitM) interception, session hijacking, or denial of service. Since ARP has no built-in authentication mechanism, any device on a broadcast domain can forge ARP replies. Detection requires monitoring ARP traffic for anomalies such as gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses. This skill covers deploying multiple detection layers including ARPWatch, Dynamic ARP Inspection (DAI), Wireshark-based analysis, and custom Python monitoring tools.

When to Use

• When investigating security incidents that require detecting arp poisoning in network traffic
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Access to the target network segment (broadcast domain)
• Linux host for ARPWatch and custom monitoring tools
• Managed switches supporting Dynamic ARP Inspection (Cisco Catalyst, Aruba, Juniper EX)
• Wireshark or tcpdump for packet capture
• DHCP snooping configured (prerequisite for DAI)
• Network monitoring infrastructure (SIEM, syslog server)

Core Concepts

ARP Protocol Fundamentals

ARP maps IP addresses to MAC addresses on a local network segment. The protocol operates statelessly with no authentication:

Normal ARP Process:
1. Host A broadcasts: "Who has 10.0.1.1? Tell 10.0.1.100"
2. Router replies: "10.0.1.1 is at AA:BB:CC:DD:EE:01"
3. Host A caches the mapping

ARP Poisoning Attack:
1. Attacker sends unsolicited ARP reply to Host A:
   "10.0.1.1 is at EV:IL:MA:CA:DD:RR" (attacker's MAC)
2. Host A updates cache, sends traffic to attacker
3. Attacker forwards to real gateway (MitM position)

Attack Indicators

Workflow

Step 1: Deploy ARPWatch for Continuous Monitoring

# Install ARPWatch
sudo apt-get install -y arpwatch

# Configure ARPWatch
sudo vi /etc/default/arpwatch
# INTERFACES="eth0"
# ARGS="-N -p -i eth0 -f /var/lib/arpwatch/arp.dat"

# Start monitoring
sudo systemctl enable arpwatch
sudo systemctl start arpwatch

# View current ARP database
cat /var/lib/arpwatch/arp.dat

# Monitor logs for changes
tail -f /var/log/syslog | grep arpwatch

ARPWatch alert types:

• new station - Previously unseen MAC address
• changed ethernet address - IP mapped to different MAC (potential poisoning)
• flip flop - MAC alternating between two addresses (active attack)
• reused old ethernet address - Previously seen mapping returned

Step 2: Configure Dynamic ARP Inspection (DAI) on Switches

Cisco Catalyst configuration:

! Enable DHCP snooping (prerequisite for DAI)
ip dhcp snooping
ip dhcp snooping vlan 10,20,30

! Configure trusted ports (uplinks, DHCP servers)
interface GigabitEthernet1/0/1
 description Uplink to Distribution
 ip dhcp snooping trust

interface GigabitEthernet1/0/48
 description DHCP Server
 ip dhcp snooping trust

! Enable Dynamic ARP Inspection
ip arp inspection vlan 10,20,30

! Configure trusted ports for DAI
interface GigabitEthernet1/0/1
 ip arp inspection trust

! Set rate limits to prevent ARP flood DoS
interface range GigabitEthernet1/0/2-47
 ip arp inspection limit rate 15

! Enable additional validation checks
ip arp inspection validate src-mac dst-mac ip

! Configure ARP ACL for static IP devices (servers, printers)
arp access-list STATIC-ARP-ENTRIES
 permit ip host 10.0.10.100 mac host 0011.2233.4455
 permit ip host 10.0.10.101 mac host 0011.2233.4456

ip arp inspection filter STATIC-ARP-ENTRIES vlan 10

! Verify DAI status
show ip arp inspection vlan 10
show ip arp inspection statistics
show ip dhcp snooping binding

…