Justin Corpuz

ARP Spoofing Mitigation Research

Introduction

Address Resolution Protocol (ARP) is a fundamental component of Local Area Networks (LANs), mapping IP addresses to MAC addresses. However, ARP lacks built-in security mechanisms, making it vulnerable to spoofing attacks, where an attacker associates their MAC address with a legitimate IP address to intercept or manipulate communication. This research investigates an encryption-based mitigation approach using cryptographic techniques such as HMAC (Hash-based Message Authentication Code) and SipHash to secure ARP requests and replies while maintaining efficiency.

Design

Traditional ARP spoofing mitigation techniques, such as static ARP tables and intrusion detection systems, often suffer from scalability and performance issues. Cryptographic solutions like AES and RSA have been proposed in the past but introduce significant processing overhead. This research explores the use of lightweight cryptographic techniques that ensure the authenticity of ARP messages without requiring extensive protocol modifications.

A controlled lab environment was set up using Oracle VirtualBox with Ubuntu 20.04 and Docker containers to simulate an ARP spoofing attack. Three hosts were configured:

Testing involved baseline spoofing attacks, implementing cryptographic protection, and monitoring network traffic using Wireshark to verify the effectiveness of the mitigation techniques.

My goal

My goals included:

Results & Conclusion

Testing revealed that implementing HMAC and SipHash effectively prevented ARP spoofing attacks by ensuring that only legitimate devices could respond to ARP requests. The round-trip time (RTT) for ARP resolution increased slightly but remained within acceptable limits for real-time network communication.

Pros:

Cons:

While cryptographic authentication improves ARP security, practical deployment remains limited due to standardization concerns. Alternative security measures, such as dynamic ARP inspection (DAI) and VLAN segmentation, may provide more scalable solutions for enterprise networks.

This research contributes to the ongoing efforts in cybersecurity by proposing an efficient approach to mitigating ARP spoofing while maintaining network performance.

References