I am planning to develop a Ruby script that detects ARP spoofing attacks on a local network, I have a few questions about it. There are three scenarios I am taking into consideration:
First idea as always is a basic idea. If ARP poisoning is performed, my packets are flowing to the attacker and from there to the router. The router’s MAC address in my ARP table will be the attacker's. In this situation, there will be a duplicate MAC address in the ARP table with a different IP. So, I plan to read the ARP table with sub-procces (ARP -a), if there are any duplicate mac addresses, I assume ARP spoofing is done to me. But this is very simple and an inadequate solution.
If the intruder wants only to cut me off the internet connection. He/She can bypass this protection (my script :)) by sending ARP packet only to the router and say 'victim’s MAC address is this', and send a fake MAC address to the router pretending to be me. Then there will be no duplicate entry in my ARP table for me to detect. What I think to do is send everyone in the network ICMP, collect the original MAC addresses, and then match them with the MAC addresses in the ARP table.
- What I wrote above is not enough. My plan is to detect attacks in the network but the intruder may not do anything to me and instead send the ARP packets to another machine on the network. I do not know exactly what to do with this situation, I have a an idea but I am not sure, I have a few question about this scenario: Are all ARP packets broadcast? Can I listen to all ARP packets on the network? Can I access the router's ARP table?
I did not find the exact answer to these questions, I need your advice :).
How do I handle this problem with Ruby? Where should I look?