I'm a little bit rusty with MITM attack and its preventions.

Where is the right network position where to install arpwatch? If you place it in the router you can only prevent host2gateway mitm. To prevent intra-netwrok MITM (host to host connection), you should place an instance of arpwatch on each node.

Am I right?


Arpwatch won't prevent MITM attacks but will just monitor ARP activity and concerning MITM, the ARP protocol isn't the only way to do a MITM (eg : ICMP redirect, DNS spoofing, port stealing, DHCP spoofing...).

But if your goal is to detect host to host ARP poisoning attempts of all your network, yes you have to place an instance on each host. But I think the most efficient way to avoid ARP spoofing attacks is to use static ARP entries.


To capture the combinations of IP -> HW addresses for each host, you'd have to put it on each host. (And tally up different outputs; i.e if you have 3 hosts: A, B and C. You want to ensure that both A and B have the same hardware address of C). This may be cumbersome.

Typically, though, it would be easier to monitor traffic that leaves the LAN, which is though your gateway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.