0

Wireshark can detect these kind of activites, and warn us by a 'duplicated ip address' message. Why doesn't the router act like this? The other way is to check the cache, and don't allow two different ip address for a single mac address.

I think it is easy to prevent, but network hosts are just let it happen. Why?

1
1

The other way is to check the cache, and don't allow two different ip address for a single mac address.

I want to start here because this is a very bad idea. There are many situations where a single MAC may have multiple valid IP addresses, especially in an IPv6 world.

Wireshark can detect these kind of activites, and warn us by a 'duplicated ip address' message.

Wireshark is highlighting in these cases a IP address potentially has more than one MAC address in the traffic. This may be a duplicate IP address, but it also may be a valid configuration.

Why doesn't the router act like this? ... I think it is easy to prevent, but network hosts are just let it happen. Why?

It all depends on the router, network and configuration in question.

Many routers will detect and log/alert when there is the possibility of a duplicate IP address. Some routers will not update an ARP entry in their tables until the old entry ages out or is manually removed.

Hosts can be configured to handle this in different ways as well, depending on the OS.

Why isn't there a defense system against ARP poisoning?

There is, it is often called dynamic ARP inspection or DAI and it is present as a feature on many platforms. If you use an enterprise network solution, it is almost guaranteed to be there in some form; it becomes less common as you move down towards SOHO and consumer devices, but can still be found in some, often with simplified configuration and terminology (i.e. there may be a simple check box to enable a number of end point security features).

DAI often works in conjunction with features such as DHCP snooping (which helps to prevent rogue DHCP servers) and works by building a "binding" table between client IP and MAC addresses. If the information provided by an ARP packet doesn't match an entry in the binding table, it is discarded.

0

steffen's comment is right - the short answers is that such things do exist. They're not typically turned on on most consumer devices because this would lead to general confusion amongst most of the population trying to understand what warnings would mean, and there's little benefit in a company wanting to take on the support of those issues, when there's not benefit in it for them.

Additionally, it just doesn't happen commonly enough in a way that it's a problem for it to be a problem worth solving. Most important communication is secured these days, which should solve the problems more categorically, assuming people pay attention to browser warnings or get the choice to continue anyway (increasingly not).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy