Stop Partial ARP Spoofing

G5 Cyber Security

2 weeks ago

TL;DR

Partial ARP spoofing means an attacker can redirect some traffic but not all. This guide shows how to identify and block it, focusing on static ARP entries, port security, and network monitoring.

Understanding the Problem

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses. ARP spoofing tricks devices into associating the wrong MAC address with a correct IP address, allowing an attacker to intercept traffic. Partial success usually means some devices are protected by static ARP entries or other security measures.

Solution Guide

Confirm Spoofing is Happening: Use tools like Wireshark or `arp -a` (on Linux/macOS) to check for incorrect MAC address mappings. Look for multiple entries for the same IP address, especially if they don’t match known devices.
- Linux/macOS:
```
arp -a
```
- Windows:
```
arp -a
```
Static ARP Entries: This is the most common defence. Configure static entries for critical devices (routers, servers) on your machines.
- Linux/macOS: Edit `/etc/arp` as root and add a line like this:
```
192.168.1.1 00:11:22:33:44:55
```
  (Replace with your router’s IP and MAC address). Then run
```
sudo arp -d 192.168.1.1
```
  followed by
```
sudo arp -a
```
  to confirm.
- Windows: Use the command prompt as an administrator:
```
arp -s 192.168.1.1 00:11:22:33:44:55
```
  (Replace with your router’s IP and MAC address). Then run
```
arp -a
```
  to confirm.
Port Security (Switches): If you control the network switches, enable port security. This limits which MAC addresses can connect to each port.
- Configure a switch port to only allow traffic from the MAC address of your computer’s network interface card (NIC).
- Most managed switches have a web interface for this; consult your switch’s manual.
DHCP Snooping (Switches): Enable DHCP snooping on your switches to prevent rogue DHCP servers from distributing incorrect IP addresses.
- This also helps with ARP poisoning by validating MAC address-IP bindings.
- Again, consult your switch’s manual for configuration details.
Network Monitoring: Use a network intrusion detection system (NIDS) or security information and event management (SIEM) tool to detect ARP spoofing attempts.
- Wireshark can be used for real-time monitoring, looking for gratuitous ARP replies.
- Suricata or Snort are examples of NIDS tools that can alert you to suspicious ARP traffic.
Firewall Rules: Some firewalls allow you to filter ARP packets based on source and destination IP/MAC addresses.
- This is a more advanced technique, requiring careful configuration to avoid blocking legitimate traffic.
Regularly Check ARP Tables: Make it a habit to periodically review your ARP tables for any unexpected entries.

By implementing these steps, you can significantly reduce the risk of successful ARP spoofing attacks and mitigate partial compromises.