On investigating ARP spoofing security solutions

Zouheir Trabelsi, Wassim El-Hajj

Research output: Contribution to journalArticlepeer-review

15 Citations (Scopus)


The address resolution protocol (ARP) has proven to work well under regular circumstances, but it was not designed to cope with malicious hosts. By performing ARP spoofing attacks, a malicious host can either impersonate another host [man-in-the-middle attack (MiM)] and gain access to sensitive information, or perform denial of service attack (DoS) on target hosts. Several security solutions, such as high-cost LAN switches and intrusion detection or prevention systems (IDS/IPS), are currently used to detect and prevent these attacks. In this paper, we evaluate, through extensive practical experiments, how effective these security solutions are in detecting ARP spoofing. We clearly show that ARP spoofing has not been given enough attention by most common security solutions which lack efficient detection and prevention mechanisms. We then propose an optimal algorithm that is capable of detecting all various ARP spoofing attacks; especially those not detected using the current mechanisms. The suggested algorithm can be easily integrated in any available security solution with very minimal overhead.

Original languageEnglish
Pages (from-to)92-100
Number of pages9
JournalInternational Journal of Internet Protocol Technology
Issue number1-2
Publication statusPublished - Apr 2010


  • ARP spoofing
  • Denial of services attack
  • DoS
  • Intrusion detection system
  • Man-in-the-middle attack
  • MiM

ASJC Scopus subject areas

  • Computer Networks and Communications


Dive into the research topics of 'On investigating ARP spoofing security solutions'. Together they form a unique fingerprint.

Cite this