Stop Router ARP Poisoning

TL;DR

Someone might be trying to intercept your network traffic using ARP spoofing from your router (or pretending to be it). This guide shows you how to check for this and strengthen your cyber security. It involves checking ARP tables, enabling ARP inspection on your router if possible, and potentially using static ARP entries.

What’s happening?

ARP (Address Resolution Protocol) links IP addresses to physical MAC addresses on your network. An attacker can send fake ARP messages, telling devices the wrong MAC address is associated with an IP address – this redirects traffic through their machine. If it’s coming from *your* router, something’s seriously wrong; either it’s compromised or misconfigured.

Step-by-step solution

1. Check your ARP table: This shows you which IP addresses are linked to which MAC addresses. Look for anything suspicious – multiple entries for the same IP address, or a MAC address that doesn’t seem right.
   • Windows: Open Command Prompt and type

     arp -a

     .

   • macOS/Linux: Open Terminal and type

     arp -an

     .

   • Examine the output. Pay attention to the IP address and corresponding MAC address columns. If you see duplicate IPs with different MACs, or a MAC that doesn’t match known devices (like your phone or laptop), investigate further.
2. Identify the rogue device: If you find suspicious entries in the ARP table:
   • Try to ping the IP address associated with the suspect MAC address.

     ping [IP Address]

     . If it responds, note its location (if possible).

   • Use a network scanner like Nmap (https://nmap.org/) to get more information about the device. This is more advanced but can reveal the operating system and open ports.
3. Router ARP Inspection (Highly Recommended): Many routers have a feature called ‘ARP inspection’ or ‘Dynamic ARP Inspection (DAI)’ which helps prevent ARP spoofing.
   • Access your router’s configuration: Open a web browser and enter your router’s IP address (usually 192.168.1.1 or 192.168.0.1). You’ll need the administrator username and password.
   • Find ARP Inspection settings: The location varies by router manufacturer. Look for sections like ‘Security’, ‘LAN Settings’, or ‘Advanced Settings’. Search your router’s manual if you can’t find it.
   • Enable ARP inspection: Turn this feature on. Some routers allow you to specify trusted ports (e.g., the port connected to your internet modem).
4. Static ARP Entries (Advanced): For critical devices, you can create static ARP entries. This tells your network to always associate a specific IP address with a specific MAC address.
   • Windows: Open Command Prompt as administrator and use the following command:

     arp -s [IP Address] [MAC Address]

     For example:

     arp -s 192.168.1.10 AA:BB:CC:DD:EE:FF

   • macOS/Linux: Open Terminal and use the following command:

     sudo arp -s [IP Address] [MAC Address]

     For example:

     sudo arp -s 192.168.1.10 AA:BB:CC:DD:EE:FF

   • Caution: Incorrect static ARP entries can cause network connectivity problems. Only use this for devices you absolutely trust and know the correct MAC address of.
5. Router Firmware Update: Ensure your router has the latest firmware installed. Updates often include cyber security patches.
   • Access your router’s configuration (as in Step 3).
   • Look for a ‘Firmware Update’ or ‘System Update’ section.
   • Follow the on-screen instructions to update the firmware.
6. Change Router Password: Use a strong, unique password for your router’s administrator account.