Spoofed ARP packets detection in switched LAN networks

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    2 Citations (Scopus)

    Abstract

    Spoofed ARP packets are used by malicious users to redirect network's traffic to their hosts. The potential damage to a network from an attack of this nature can be very important. This paper discusses first how malicious users redirect network traffic using spoofed ARP packets. Then, the paper proposes a practical and efficient mechanism for detecting malicious hosts that are performing traffic redirection attack against other hosts in switched LAN networks. The proposed mechanism consists of sending first spoofed packets to the network's hosts. Then, by collecting and analyzing the responses packets, it is shown how hosts performing traffic redirection attack can be identified efficiently and accurately. The affect of the proposed mechanism on the performance of the network is discussed and shown to be minimal. The limits of current IDSs regarding their ability to detect malicious traffic redirection attack, based on spoofed ARP packets, in switched LAN networks are discussed. Our work is concerned with the detection of malicious network traffic redirection attack, at the Data Link layer. Other works proposed protection mechanisms against this attack, but at the Application layer, using cryptographic techniques and protocols.

    Original languageEnglish
    Title of host publicationSECRYPT 2006 - International Conference on Security and Cryptography, Proceedings
    Pages40-47
    Number of pages8
    Publication statusPublished - Dec 1 2006
    EventInternational Conference on Security and Cryptography, SECRYPT 2006 - Setubal, Portugal
    Duration: Aug 7 2006Aug 10 2006

    Publication series

    NameSECRYPT 2006 - International Conference on Security and Cryptography, Proceedings

    Other

    OtherInternational Conference on Security and Cryptography, SECRYPT 2006
    Country/TerritoryPortugal
    CitySetubal
    Period8/7/068/10/06

    Keywords

    • ARP cache poisoning
    • Intrusions detection systems
    • Packet sniffers
    • Spoofed ARP

    ASJC Scopus subject areas

    • Computer Science Applications
    • Software

    Fingerprint

    Dive into the research topics of 'Spoofed ARP packets detection in switched LAN networks'. Together they form a unique fingerprint.

    Cite this