SPOOFED ARP PACKETS DETECTION IN SWITCHED LAN NETWORKS

Zouheir Trabelsi, Khaled Shuaib

Abstract

Spoofed ARP packets are used by malicious users to redirect network’s traffic to their hosts. The potential damage to a network from an attack of this nature can be very important. This paper discusses first how malicious users redirect network traffic using spoofed ARP packets. Then, the paper proposes a practical and efficient mechanism for detecting malicious hosts that are performing traffic redirection attack against other hosts in switched LAN networks. The proposed mechanism consists of sending first spoofed packets to the network’s hosts. Then, by collecting and analyzing the responses packets, it is shown how hosts performing traffic redirection attack can be identified efficiently and accurately. The affect of the proposed mechanism on the performance of the network is discussed and shown to be minimal. The limits of current IDSs regarding their ability to detect malicious traffic redirection attack, based on spoofed ARP packets, in switched LAN networks are discussed. Our work is concerned with the detection of malicious network traffic redirection attack, at the Data Link layer. Other works proposed protection mechanisms against this attack, but at the Application layer, using cryptographic techniques and protocols.

References

  1. Plummer, David C, 1982. An Ethernet Address Resolution Protocol-Converting Network Protocol to 48 bit Ethernet Address for Transmission on Ethernet Hardware, RFC-826.
  2. Postel, J, 1981. Internet Control Message Protocol, RFC792.
  3. Richard Stevens, 2001. TCP/IP Illustrated: Volume 1.
  4. Daiji Sanai, 2004. Detection of Promiscuous Nodes Using ARP Packets, http://www.securityfriday.com
  5. Zouheir Trabelsi et.al., 2004. Detection of Sniffers in an Ethernet Network, in the 7th Information Security Conference, ISC 2004, Palo Alto, CA, USA.
  6. Zouheir Trabelsi et.al, 2005. An Anti-Sniffer Based on ARP Cache Poisoning Attack, in the Information System Security Journal, Auerbach Publications, NY, USA, Volume 13, Issue 6.
Download


Paper Citation


in Harvard Style

Trabelsi Z. and Shuaib K. (2006). SPOOFED ARP PACKETS DETECTION IN SWITCHED LAN NETWORKS . In Proceedings of the International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2006) ISBN 978-972-8865-63-4, pages 40-47. DOI: 10.5220/0002102400400047


in Bibtex Style

@conference{secrypt06,
author={Zouheir Trabelsi and Khaled Shuaib},
title={SPOOFED ARP PACKETS DETECTION IN SWITCHED LAN NETWORKS},
booktitle={Proceedings of the International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2006)},
year={2006},
pages={40-47},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0002102400400047},
isbn={978-972-8865-63-4},
}


in EndNote Style

TY - CONF
JO - Proceedings of the International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2006)
TI - SPOOFED ARP PACKETS DETECTION IN SWITCHED LAN NETWORKS
SN - 978-972-8865-63-4
AU - Trabelsi Z.
AU - Shuaib K.
PY - 2006
SP - 40
EP - 47
DO - 10.5220/0002102400400047