Spoofed ARP packets detection in switched LAN networks

Research output: Chapter in Book/Report/Conference proceedingConference contribution

7 Citations (Scopus)


Spoofed ARP packets are used by malicious users to redirect network’s traffic to their hosts. The potential damage to a network from an attack of this nature can be very important. This paper discusses first how malicious users redirect network traffic using spoofed ARP packets. Then, the paper proposes a practical and efficient mechanism for detecting malicious hosts that are performing traffic redirection attack against other hosts in switched LAN networks. The proposed mechanism consists of sending first spoofed packets to the network’s hosts. Then, by collecting and analyzing the responses packets, it is shown how hosts performing traffic redirection attack can be identified efficiently and accurately. The affect of the proposed mechanism on the performance of the network is discussed and shown to be minimal. The limits of current IDSs regarding their ability to detect malicious traffic redirection attack, based on spoofed ARP packets, in switched LAN networks are discussed. Our work is concerned with the detection of malicious network traffic redirection attack, at the Data Link layer. Other works proposed protection mechanisms against this attack, but at the Application layer, using cryptographic techniques and protocols.

Original languageEnglish
Title of host publicationE-Business and Telecommunication Networks - 3rd International Conference, ICETE 2006, Selected Papers
EditorsJoaquim Filipe, Mohammad S. Obaidat
PublisherSpringer Verlag
Number of pages11
ISBN (Print)9783540707592
Publication statusPublished - 2008
EventInternational Joint Conference on e-Business and Telecommunications, ICETE 2006 - Setubal, Portugal
Duration: Aug 7 2006Aug 10 2006

Publication series

NameCommunications in Computer and Information Science
ISSN (Print)1865-0929
ISSN (Electronic)1865-0937


OtherInternational Joint Conference on e-Business and Telecommunications, ICETE 2006


  • ARP cache poisoning
  • Intrusions detection systems
  • Packet sniffers
  • Spoofed ARP

ASJC Scopus subject areas

  • General Computer Science
  • General Mathematics


Dive into the research topics of 'Spoofed ARP packets detection in switched LAN networks'. Together they form a unique fingerprint.

Cite this