/detecting-arp-poisoning-in-network-traffic

name: detecting-arp-poisoning-in-network-traffic
description: Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom
  monitoring scripts to protect against man-in-the-middle interception.
domain: cybersecurity
subdomain: network-security
tags:
- arp-poisoning
- arp-spoofing
- mitm
- dynamic-arp-inspection
- arpwatch
- network-security
- man-in-the-middle
- layer-2-security
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.IR-01
- DE.CM-01
- ID.AM-03
- PR.DS-02

Detecting ARP Poisoning in Network Traffic

Overview

ARP poisoning (ARP spoofing) is a Layer 2 attack where an adversary sends falsified ARP messages to associate their MAC address with the IP address of a legitimate host, enabling man-in-the-middle (MitM) interception, session hijacking, or denial of service. Since ARP has no built-in authentication mechanism, any device on a broadcast domain can forge ARP replies. Detection requires monitoring ARP traffic for anomalies such as gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses. This skill covers deploying multiple detection layers including ARPWatch, Dynamic ARP Inspection (DAI), Wireshark-based analysis, and custom Python monitoring tools.

When to Use

• When investigating security incidents that require detecting arp poisoning in network traffic
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Access to the target network segment (broadcast domain)
• Linux host for ARPWatch and custom monitoring tools
• Managed switches supporting Dynamic ARP Inspection (Cisco Catalyst, Aruba, Juniper EX)
• Wireshark or tcpdump for packet capture
• DHCP snooping configured (prerequisite for DAI)
• Network monitoring infrastructure (SIEM, syslog server)

Core Concepts

ARP Protocol Fundamentals

ARP maps IP addresses to MAC addresses on a local network segment. The protocol operates statelessly with no authentication:

Normal ARP Process:
1. Host A broadcasts: "Who has 10.0.1.1? Tell 10.0.1.100"
2. Router replies: "10.0.1.1 is at AA:BB:CC:DD:EE:01"
3. Host A caches the mapping

ARP Poisoning Attack:
1. Attacker sends unsolicited ARP reply to Host A:
   "10.0.1.1 is at EV:IL:MA:CA:DD:RR" (attacker's MAC)
2. Host A updates cache, sends traffic to attacker
3. Attacker forwards to real gateway (MitM position)

Attack Indicators

| Indicator | Description | Severity | |-----------|-------------|----------| | MAC flip-flopping | Same IP mapped to different MACs rapidly | High | | Gratuitous ARP flood | Unsolicited ARP replies targeting multiple hosts | High | | Duplicate IP address | Two different MACs claiming same IP | Critical | | Unusual ARP volume | Spike in ARP packets per second | Medium | | ARP from non-DHCP source | Static IP claims from unknown devices | Medium | | Gateway MAC change | Default gateway MAC address changed | Critical |

Workflow

Step 1: Deploy ARPWatch for Continuous Monitoring

# Install ARPWatch
sudo apt-get install -y arpwatch

# Configure ARPWatch
sudo vi /etc/default/arpwatch
# INTERFACES="eth0"
# ARGS="-N -p -i eth0 -f /var/lib/arpwatch/arp.dat"

# Start monitoring
sudo systemctl enable arpwatch
sudo systemctl start arpwatch

# View current ARP database
cat /var/lib/arpwatch/arp.dat

# Monitor logs for changes
tail -f /var/log/syslog | grep arpwatch

ARPWatch alert types:

• **new station** - Previously unseen MAC address
• **changed ethernet address** - IP mapped to different MAC (potential poisoning)
• **flip flop** - MAC alternating between two addresses (active attack)
• **reused old ethernet address** - Previously seen mapping returned

Step 2: Configure Dynamic ARP Inspection (DAI) on Switches

**Cisco Catalyst configuration:**

! Enable DHCP snooping (prerequisite for DAI)
ip dhcp snooping
ip dhcp snooping vlan 10,20,30

! Configure trusted ports (uplinks, DHCP servers)
interface GigabitEthernet1/0/1
 description Uplink to Distribution
 ip dhcp snooping trust

interface GigabitEthernet1/0/48
 description DHCP Server
 ip dhcp snooping trust

! Enable Dynamic ARP Inspection
ip arp inspection vlan 10,20,30

! Configure trusted ports for DAI
interface GigabitEthernet1/0/1
 ip arp inspection trust

! Set rate limits to prevent ARP flood DoS
interface range GigabitEthernet1/0/2-47
 ip arp inspection limit rate 15

! Enable additional validation checks
ip arp inspection validate src-mac dst-mac ip

! Configure ARP ACL for static IP devices (servers, printers)
arp access-list STATIC-ARP-ENTRIES
 permit ip host 10.0.10.100 mac host 0011.2233.4455
 permit ip host 10.0.10.101 mac host 0011.2233.4456

ip arp inspection filter STATIC-ARP-ENTRIES vlan 10

! Verify DAI status
show ip arp inspection vlan 10
show ip arp inspection statistics
show ip dhcp snooping binding

Step 3: Wireshark Detection Filters

# Detect gratuitous ARP (sender and target IP are the same)
arp.src.proto_ipv4 == arp.dst.proto_ipv4

# Detect ARP replies (focus on unsolicited)
arp.opcode == 2

# Detect duplicate IP address claims
arp.duplicate-address-detected

# Detect ARP packets from specific attacker MAC
eth.src == ev:il:ma:ca:dd:rr

# Detect ARP storms (high volume)
# Use Statistics > I/O Graphs > Display filter: arp

# Detect gateway impersonation
arp.src.proto_ipv4 == 10.0.1.1 && arp.src.hw_mac != aa:bb:cc:dd:ee:01

Step 4: Custom Python ARP Monitor

#!/usr/bin/env python3
"""
Real-time ARP poisoning detection using packet capture.
Monitors ARP traffic for spoofing indicators and alerts on anomalies.
"""

import subprocess
import sys
import json
import time
from collections import defaultdict
from datetime import datetime

try:
    from scapy.all import sniff, ARP, Ether, get_if_hwaddr, conf
    SCAPY_AVAILABLE = True