Page 14 - 2023-Vol19-Issue2

10 |
For attack detection, a Python script utilizing the Scapy mod-
ule is used. After the contents of the request packet have been
verified, an alert is sent if the original Mac does not match
the reply Mac, and a static item is stored in a cache table as
a security precaution. The proposed method does not permit
dynamic entries. Rather than creating a script for spoofing,
the existing available tools may be utilized to undertake Kali
Linux assaults and packet analysis.
Alsukkar et al. [17]The researchers suggest a few meth-
ods, one of which is using an application that alerts the user of is used to determine the MAC address of a device on your
an ARP spoofing attack by displaying the attacker’s IP-Mac
address to identify and defend against MITM assaults. Each
network node’s genuine Mac address and the results of a ping
ICMP message are sent to the router for additional security.
There has been a reversion to the previous ARP table configu-
rations. The application is loaded on the administrator’s and
the users’ computers. Additionally, the network configuration
may attack and corrupt the ARP table. Both programmes
proved valuable and workable, and they were both developed
in Python for use only on the Linux platform. The proposed
investigation into alternative OSes, however, has been ineffec-
tive. Sending packets to all devices per second causes a lot of
network traffic.
Mahendra [18]The researcher’s method improves the ARP
table static input process by reducing the time-consuming
manual entry methods and automatically evaluating the cor-
rectness of data entered into the static table. The strategy
worked well by using the static record feature of some op-
erating systems, such as Linux and Windows, to create a
semi-static table for the cache. In a virtual network, packets
are sent, and the validity of the responses is verified before
they are added to the table using an ARPing tool. As a result,
the suggested solution does not ensure the safety of all net-
work users. Instead, it must give a white list of trustworthy
IP-MAC addresses that may be used to evaluate the ARPing
tool’s ability to add to the static record.
Rupal et al.[19]This article explains how an authentication
tool may also be used to identify and avoid ARP poisoning in
a dynamic IP configuration. The primary ARP cache stores
the authentication information for IP-MAC pairings, which is
subsequently saved in a text file in the secondary ARP cache.
One server sets up IP DHCP, another uses MySQL and a
database to authenticate users, and the third server monitors
for and prevents cache poisoning attacks. To detect and pre-
vent attacks, all devices receive an ICMP broadcast request
and reply message. Due to its failure to transmit a response,
the IP-Mac is deleted from the secondary and primary ARP
caches. On the other hand, broadcasting requests make the
system less useful because the network gets clogged up, the
server has to be managed by authorized people, and only
reliable storage facilities can be used.
Nasser & Hussain
III. BACKGROUND
A. Address Resolution Protocol
The Address Resolution Protocol (ARP) is one of the major
protocols in the TCP/IP suite[20]. ARP aims to map an IPv4
address to a physical address. Network applications at the
application layer use IPv4 addresses to communicate with
other devices. But at the data link layer, the address is a MAC
address permanently burned into the network card. ARP
LAN as well as the corresponding IPv4 address with which a
network application is attempting to communicate[21].
In contrast, static mapping requires the creation of a database
that connects a logical address with a physical address[22].
This table is saved on each network computer. Each device
that knows the IP address but not the physical address of
another device may look it up in the database. The static
mapping table must be routinely updated when devices’ MAC
addresses change. This may impact network performance[23].
Dynamic mapping implements a distinct situation. When
a computer knows the logical address of another device, it
may use a protocol to determine the device’s physical address.
Two protocols, ARP and Reverse(RARP), have been created
to accomplish dynamic mapping (RARP)[24]. ARP converts
logical addresses to physical addresses, whereas RARP con-
verts physical addresses to logical addresses. Since the ARP
protocol has been the focal point of this thesis, we shall con-
fine our discussion to that protocol[24].
B. ARP Spoofing Attack
One kind of MITM attack is called ARP spoofing, and it
involves an attacker sending fake ARP packets to a local area
network[25]. The attack aims to have the victim’s network
interface card (MAC) address matched to the IP address of
another computer (such as the default gateway), redirecting all
communication intended for the other machine to the attacker.
If an attacker can fake an ARP, they may change network traf-
fic or completely block it. Many additional attacks, including
DOS attacks, MITM attacks, and session hijacking attacks,
take advantage of this vulnerability[26].
ARP spoofing is an attack method that takes advantage
of the fact that the integrity check of the ARP message is not
guaranteed and sends a fake ARP response packet to the target
to trick the MAC address and stop normal operation[27].
ARP poisoning repeatedly sends abnormal ARP response
packets to the target. Fig.1 and Fig.2 assume that the host’s IP
address (1) is ’0.0.0.1’ and the MAC address is AA.AA’, and
the host’s IP address (2) is ’0.0.0.2’ is ’CC.CC’. Fig.1 shows
the normal communication flow before the ARP spoofing
attack occurs. When attempting to communicate from Host
(1) to Host (2), a MAC address is required, and an ARP
request message is sent in the Broadcasting method to locate