Page 13 - 2023-Vol19-Issue2

9|
possibility of security incidents. ARP (Address Resolution
Protocol)have been known to have flaws since 1982, but ARP
spoofing is still being used to cause damage today, nearly 40
years later[9].
Although many studies of these security threats have been
conducted long, expensive equipment is required, so it is in-
stalled and operated only in a particular organization, static
table creation and management [10]. The current network
system’s implementation was either impossible or limited.
Therefore, this paper describes the process of an ARP poison-
ing attack and then suggests a way to defend against it. That
is, an ARP poisoning attack changes the ARP cache table
information by repeatedly sending an abnormal ARP response
packet to the target of the attack.
During this process, The ARP request packet is being mon-
itored [11]. An ARP poisoning attack is found and stopped by
analyzing and validating the information in the request packet
before sending responses[12].
Problems statement
Layer 2 connections are the most susceptible. Layer 2
protocols are risky since they don’t ensure a reliable IP-to-
MAC connection. Layer 3 devices, like routers, link multiple
subnets to allow nodes end-to-end Internet access; hence,
their security is a primary consideration when putting up a
network.ARP translates IP to MAC addresses. ARP may be
used for spying and spoofing, but the protocol was created
with security features to avoid such attacks. This section
shows ARP’s vulnerabilities[13].
• Stateless: ARP is a stateless protocol; thus, it sends
reply packets even if it hasn’t done any ARP inquiries and
doesn’t verify packet validity. This allows the attacker to
transmit bogus ARP reply packets to the victim using his
MAC address.
• No authentication: ARP depends on a secure LAN;
therefore, it’s impossible to determine whose host delivered
the ARP message. ARP spoof.
• ARP cache table update: The ARP table will rapidly up-
date its cache of IP-to-MAC mappings when an ARP request
or reply is received; however, the correctness of this informa- attacks. The recommended cure includes a static ARP table
tion is not validated. Reduces network traffic. Changing your
IP address will clear the cache.
Contributions to our proposed scheme to prevent ARP
spoofing attacks:.
[1] Without using encryption, which could slow ARP,
the attack could still be found, and alerts were sent to the
administrator about the attack scenario on time.
[2] Using packet filtering in conjunction with network
traffic monitoring to prevent ARP spoofing attacks without
negatively impacting the speed at which ARP request and
reply exchanges occur.
[3] The suggested solution doesn’t require any extra net-
Nasser & Hussain
works or hardware. It also doesn’t change the protocol. As
a result, it’s cheap and doesn’t overburden the system or net-
work.
[4] Consider all ARP assaults; periodically check the ARP
cache table, and maintain an encrypted blacklist of all po-
tential attackers so our proposal resists DOS, impersonation,
reply, and inside attacks.
[5] A technique of customizing the device’s dynamic ta-
bles and entries without respect for the router’s capabilities.
This paper details a basic client-side ARP spoofing detec-
tion and prevention approach. The algorithm filters packets
before issuing ARP requests or replies. Furthermore, it offers
a defensive method that does not require network protocol up-
grades or costly equipment. Verifying MAC and IP addresses
before sending or receiving packets prevents ARP spoofing.
Moreover, it enables safe and rapid authentication and main-
tains data and users’ confidentiality, integrity, and anonymity
via efficient encryption algorithms. Its efficacy seems to be
equivalent to that of other methods. The sections are given in
the following order: Section 2 examines the relevant literature.
The background should be clarified in Section 3. Section 4
discusses the approach used. In Section 5, the results and
testing of the proposed approach are discussed. Section 6:
Security Performance and Analysis Section 7 ends with a
summary and conclusion.
II. RELATED WORK
Prabhadevi. B [14]GNS3, the Ettercap, and Wincap packet
analyzers are also described in this work. This architecture
uses IP-MAC table comparisons between Ethernet and ARP
headers, and incorrect entries are added to a spoofed database.
Every 10 minutes, the gateway gets messages to empty the
cache, warn about cache poisoning, and add fake information
to the fake list. New hosts need an updated ARP table. This
method uses phoney data to identify attacks. Still, since the
list’s storage locations are unknown, the approach is subject
to attack and wastes time because it doesn’t function with a
real network.
Hijazi et al.[15] The studies explored many ARP diffi-
culties and suggested ways for spotting and blocking these
entry technique, type comparison, IP-Mac-based input de-
tection, and preventive measures. For system security, the
IP-Mac address in ARP must match. So you can work, re-
move the false IP-Mac. The proxy server uses the patch file
to address and correct ARP security problems. This strategy
has been proven effective; it requires no additional resources
and provides essential solutions on a small network. This
technique can add static ARP entries but not dynamic ones.
Majumdar et al.[16] The Python programming language
was used to develop a tool for ARP poisoning and spoofing.