The article discusses various types of attacks on the ARP protocol and the tools used to implement and detect them. The principal network vulnerabilities related to the lack of authentication and encryption were identified through modeling, and methods to prevent or reduce the risk were proposed. A network design was created in the GNS3 environment, which is as close to the real environment as possible. Specialized tools such as Nping, Arpspoof, and Ettercap were used to carry out the ARP-Flooding, ARP-Spoofing, and ARP-Poisoning attacks, and XArp software was used for detection.
Due to the widespread spread of cyber threats
and their constant improvement in the modern
information environment, the issue of network
security is highly relevant. As technologies are
constantly evolving, it is essential to ensure
appropriate detection and protection against
various types of attacks. One of the most
common threats to network security is ARP
attacks aimed at unauthorized interception
and acquiring confidential information. The
risk of their impact in the context of the Internet
of Things (IoT) expansion is growing due to the
constant increase in the number of connected
devices in the network [
An analysis of research on this topic has shown that there are many ways to detect and conduct various specialized attacks on network protocols, particularly on ARP, to increase the resilience of network systems.
In particular, the article by Swati Jadhav,
Arjun Thakur, Shravani Nalbalwar, Shubham
Shah, and Sankalp Chordia [
The study by Zhaozhan Chen [
In the work of Xiaohan Zhang, Lu Cao,
Zuojun Meng, and Xiaohui Yao [
In a study by Akinul Islam Jony and Arjun
Kumar Bose Arnob [
In the article by Cristina L. Abad, Rafael I.
Bonilla [
Anjana Kawshan [
The article by Huixing Xi [
The study of Mehdi Nobakht, Hadi
Mahmoudi, and Omid Rahimzadeh [
During the analysis of publications on this topic, it was found that they pay little attention to the process of modeling threats to the ARP protocol, which is essential for understanding both the specific vulnerability and the algorithm of actions and provides an opportunity to study the network’s response to specific actions of attackers. In addition to analyzing the ARP-Flooding, ARP-Spoofing, and ARP-Poisoning attacks, this article discusses their sequential execution in the modeled network, provides an overview of the reactions of network devices and end nodes, and explores the possibility of detecting attacks using the XArp tool. This allows you to identify network vulnerabilities and choose effective methods and means to eliminate them. 1.2.
To achieve this goal, this study used analysis and simulation methods. The analysis allowed us to identify vulnerabilities of the ARP protocol, potential attacks on it, and their possible consequences. The simulation was used to model attacks using the Nping, Arpspoof, and Ettercap tools in the GNS3 environment. This made it possible to practically study a network similar to a real one and identify its vulnerabilities to choose an effective method of protection in the future. The object of research is the ARP protocol and its vulnerabilities, and the subject is methods and tools for modeling attacks on the ARP protocol in the GNS3 environment and their detection using XArp.
The purpose of the article is to study various vulnerabilities of the ARP protocol and to simulate ARp-flooding, ARP-Spoofing, and ARp-poisoning attacks on the nodes of a network created in the GNS3 environment using specialized tools Nping, Arpspoof, and Ettercap and detect them using XArp.
ARP (Address et al.) establishes a correspondence between the logical IP address and the physical MAC address of a device on a local network. It allows for more efficient routing and traffic forwarding, ensuring correct communication and addressing on the network. When one device needs to communicate with another and uses its IP address, ARP makes it possible to determine the corresponding MAC address. If the latter is already known, the device can send data immediately, and if it is unknown, an ARP request is sent to obtain this information.
ARP is an integral part of the network infrastructure, so the growth of threats in the field of network security requires a detailed study of attacks on this protocol and the development of effective methods for detecting and protecting against them. The study of attacks on the ARP protocol is essential in ensuring the privacy of network communications and improving the overall security of computer systems.
The principal vulnerabilities of ARP include the following: lack of authentication and encryption of information, which makes it vulnerable to interception and cache poisoning attacks; the ability to send fake ARP messages, as there are no authentication checks for requests, responses, and ARP tables themselves; ease of cache poisoning, which leads to a violation of the correctness of network interaction.
The peculiarities of the algorithm and the
above shortcomings have led to the threat of
the following attacks:
1. ARP-Flooding is an attack carried out by
creating a broadcast storm, i.e., sending
many ARP requests to the network to
overflow ARP caches. As a result,
network performance decreases, devices
fail, incorrect ARP tables are built, which
leads to conflicts and incorrect routing,
and there is a possibility of traffic
interception.
2. ARP-Spoofing is an attack that involves
sending fake ARP responses to the
network. An attacker impersonates a
legitimate device and indicates its own
MAC address in response to requests to
redirect network traffic through itself. As
a result, unauthorized interception of
confidential information occurs with its
subsequent viewing and modification.
3. ARP-Poisoning is an attack that is a type
of ARP-Spoofing aimed at a specific
device or a group of them. The logic of its
operation is the same, i.e., the attacker
sends fake ARP responses to poison the
ARP caches of nodes, resulting in
incorrect correspondences between IP
and MAC addresses and the possibility of
redirecting traffic to illegitimate users
[
These attacks are rarely used in the form described above, usually combining their capabilities and using different implementations.
These potential threats are critical for corporate networks, where reliable and uninterrupted operation is vital. Understanding all the stages of such attacks becomes essential for assessing the possible impact on the network and further determining the necessary measures to protect the network infrastructure.
Various programs and utilities are used to
implement attacks on the ARP protocol,
including Ettercap, Cain&Abel, BetterCAP,
Scapy, Gobbler, Nping, Arpspoof, Arroison,
ARPBuilder, and others. Each has its
functionality and features, and the choice of a
particular tool depends on the user’s needs and
the goal to be achieved by the attack [
In this study, the Nping tool was chosen for the ARP-Flooding attack, Arpspoof for ARPSpoofing, and Ettercap for ARP-Poisoning, as their functionality is sufficient to achieve the goal. Detecting the fact of an attack is a necessary element for ensuring information security, so it is essential to monitor the network to identify characteristic signs constantly. In the case of the ARP protocol, it is crucial to monitor whether the device’s response time to various network operations increases, whether the ARP activity on the interfaces is too high, whether entries with the same addresses appear in the ARP tables, etc. Specialized software applications can be used for this purpose.
Table 1 compares ArpWatch, XArp, WinARPWatch, ArpStar, ARPScan, NetCut Defender, and Colasoft Capsa by their primary functions and support for different operating systems.
Considering the above comparison, the choice was made to use the XArp software tool to detect ARP attacks planned to be carried out.
The GNS3 (Graphical Network Simulator-3) tool was chosen as the modeling environment, as it allows emulating networks and testing them interactively and using authentic operating system images. An essential factor for using GNS3 is the ability to perform attacks in an isolated environment without affecting the performance of a real network. To emulate attacks on the ARP protocol, we will develop a realistic network topology in the GNS3 environment. We will add network devices and configure them to reproduce the attack scenarios—we will use Nping, Arpspoof, and Ettercap to launch the ARP-Flooding, ARPSpoofing, and ARP-Poisoning attacks. The next step is to observe the impact of these attacks on the network, detect them with XArp, and develop an effective defense strategy.
To illustrate, it is enough to create a compact network that includes a Cisco router, based on which you can configure a DHCP server for dynamic configuration of endpoint IP addressing parameters, a switch, and four workstations. Three of them will be legitimate Windows workstations (Win10-Admin, Win7User1, WinXP-User2), and the fourth will be malicious (KaliLinux-Hacker), from which attacks will be carried out using the above tools (Fig. 1). The successful configuration of the DHCP server is confirmed by the end nodes receiving IP addressing parameters (Fig. 2). There is communication between legitimate devices, and the ARP tables of network devices and workstations before the attacks are shown in Fig. 3.
The Win10-Admin workstation has the XArp application installed to detect attacks on the ARP protocol. The KaliLinux-Hacker user received the address 192.168.1.4/24.
Let us start the ARP-Flooding attack using the Nping utility. To do this, execute the corresponding command on the attacker’s workstation, which generates many ARP messages and sends them to the same network as the sending device (Fig. 4a). During the attack, the XArp application installed on the Win10-Admin workstation signals the presence of an attack in real-time (Fig. 4b).
During the attack, the switch displays relevant system messages, and the connection between endpoints is either absent or unstable with long delays (Fig. 5).
The next attack that will be modeled is ARPSpoofing using the Arpspoof utility. We use the corresponding command, in the parameters of which we specify the IP addresses of one of the legal workstations (for example, Win10Admin) and one of the network devices (for example, a router) (Fig. 6a). The attack is successfully detected using the installed XArp application (Fig. 6b). (c) (d) Figure 3: ARP tables of devices before the attack (b) Figure 4: ARP-Flooding (a) attack execution (b) attack detection (b) Figure 5: Network device response to an ARPFlooding attack (b) Figure 6: ARP-Spoofing (a) carrying out an attack (b) detecting an attack Let us display the router’s ARP table (Fig. 7). As you can see, the MAC address of the interface of the legitimate Win10-Admin workstation and the KaliLinux-Hacker workstation are the same (different IP addresses have the same MAC address). The ARP-Spoofing attack was successful. The MAC address of the network interface of the legitimate workstation has been spoofed to the MAC address of the attacker’s network interface, which means that the attacker will be able to intercept the network traffic of the legitimate workstation. Let us simulate an ARP-Poisoning attack using the Ettercap utility. To do this, select Hosts in the menu after launching it, then Scan for Hosts. As a result, the hosts are scanned (Fig. 8a). To view them again, select Hosts in the menu and click Host list (Fig. 8b). (b) Figure 8: The process of (a) scanning and (b) the result of scanning hosts in Ettercap From this list, you need to select the hosts that will be attacked. Since the application for detecting ARP attacks is installed on Win10Admin, select the IP address corresponding to this workstation and add it using Add to Target 1. As the second target address, select, for example, the IP address of the switch interface and add it using Add to Target 2 (Fig. 9). In the MITM attacks menu, select ARP poisoning, then Sniff remote connections and click OK. The attack process in the Ettercap utility is shown in Fig. 10. (b) Figure 10: Performing an ARP-Poisoning attack The attack is successfully detected by the XArp application (Fig. 11.a). Display the ARP table of the switch (Fig. 11.b).
We can see that the MAC address of the interface of the legitimate Win10-Admin workstation and the KaliLinux-Hacker workstation are the same. The ARP-poisoning attack was successful, and the MAC address was spoofed. The attacker was able to intercept the traffic of a legitimate workstation.
(a) After emulating attacks on the ARP protocol, it was determined that they can cause a decrease in network performance, disrupt the correctness of ARP tables of devices, open up the possibility of intercepting network traffic, and lead to devise failures and other negative consequences.
Having identified the weaknesses of the network, it is worth developing a strategy to protect it from this type of attack, which will include the following steps: 1. Use static ARP records to reduce the risk of unauthorized table changes. 2. Install ARP traffic monitoring and filtering systems to detect suspicious activity promptly. 3. Use traffic encryption at the link layer to complicate the analysis of ARP packets. 4. Configuring security mechanisms to protect against attacks (Dynamic ARP Inspection, DHCP Snooping, IP Source Guard). 5. Use VLANs to limit the propagation of
ARP traffic. 6. Use personal firewalls on endpoints to block unauthorized ARP packets and changes to ARP tables.
Implementing this strategy will reduce the risk of successful ARP attacks and increase the security of the network infrastructure.
As a result of step-by-step modeling of attacks on the ARP protocol using the Nping, Arpspoof, and Ettercap utilities, it was found that the built network has specific weaknesses related to insufficient control and security of the internal network infrastructure. The resulting possibility of unauthorized access can cause device malfunctions, MAC address spoofing, and network traffic interception. Following the proposed security strategy, it is essential to consider these risks when designing and configuring the network to prevent unauthorized access. Further research may include analyzing the vulnerabilities of other protocols and developing effective security methods with practical demonstrations of their operation.