Stop ARP Poisoning of Mobile Traffic

TL;DR

ARP poisoning can let attackers intercept your mobile traffic even on secure Wi-Fi. This guide shows you how to detect and block it, focusing on practical steps for home networks.

What is ARP Poisoning?

ARP (Address Resolution Protocol) translates IP addresses (like 192.168.1.10) into MAC addresses (unique hardware IDs). ARP poisoning happens when someone sends fake ARP messages, telling devices the wrong MAC address corresponds to an IP address. This redirects traffic through the attacker’s machine.

Detecting ARP Poisoning

1. Check your ARP table: Use a tool to see if multiple MAC addresses are associated with the same IP address.
• Windows: Open Command Prompt and run

  arp -a

  . Look for duplicate IPs with different MACs.

• Linux/macOS: Open Terminal and run

  arp -an

  . Again, look for duplicates.

2. Network Monitoring Tools: Wireshark or similar tools can capture network traffic and highlight suspicious ARP requests. Look for replies that don’t match expected pairings.
3. ARP Spoofing Detection Software: Several free tools (like Arpwatch) monitor your network for changes in the ARP table and alert you to potential attacks.

Blocking ARP Poisoning

1. Static ARP Entries: Manually define the correct IP-to-MAC address mappings on critical devices (like your router). This prevents attackers from changing them.
   • Windows:

     arp -s 192.168.1.1 AA:BB:CC:DD:EE:FF

     (Replace with your router’s IP and MAC address)

   • Linux/macOS: Edit the /etc/arp file (requires root privileges). Add a line like

     192.168.1.1 AA:BB:CC:DD:EE:FF

     . You may need to restart networking for this to take effect.

2. Port Security on Switches (if applicable): If you have a managed switch, enable port security. This limits which MAC addresses can connect to each port.
   • Configure the switch to only allow the MAC address of your router and other trusted devices on specific ports.
3. DHCP Snooping (if applicable): If your switch supports it, enable DHCP snooping. This prevents rogue DHCP servers from distributing incorrect IP addresses.
4. 802.1x Authentication: More complex to set up, but provides strong authentication and authorization before granting network access.
5. Use a Strong Router Firewall: Ensure your router’s firewall is enabled and configured correctly. Most modern routers have basic ARP protection features; check the documentation.
   • Look for options like ‘ARP inspection’, ‘Dynamic ARP Inspection (DAI)’, or similar in your router’s settings.
6. Regularly Reboot Your Router: This clears the ARP cache, forcing devices to re-request mappings. It’s a temporary fix but can disrupt an ongoing attack.

Protecting Mobile Devices

1. Use HTTPS whenever possible: While ARP poisoning intercepts traffic *to* the router, HTTPS encrypts the data itself, making it unreadable even if intercepted.
2. Be cautious on public Wi-Fi: Avoid sensitive transactions on untrusted networks. Use a VPN to encrypt all your traffic.
   • A VPN creates a secure tunnel between your device and a remote server, protecting your data from local network attacks.
3. Keep your mobile OS updated: Security updates often include fixes for vulnerabilities that attackers could exploit.