I'm writing a program that detects ARP poiosoning.

My question is:

How can I b sure my LAN hasn't been poisoned? Yes, I can use my settings and find the IP address of the default gateway and yes I can get the MAC Address of my gateway and compare it, but both IP and MAC address are easy to spoof.

  • 1
    I'm confused, you are designing a process to detect ARP poisoning, but you need to know the process to detect ARP poisoning? It sort of sounds like you are asking us to create this program for you.
    – schroeder
    Commented Apr 7, 2015 at 23:20
  • I know how it works. I'm using the IP and MAC address of th gateway to determine if any other packets ARP packets are present with different details, then for sure I'm being snooped. I want to know, since an attacker can change their mac address as well, would there be a better way to determine if the packet's actually coming from the default gateway?
    – magna_nz
    Commented Apr 7, 2015 at 23:31
  • The simplest way is to look for gratuitous ARP replies, but I'm assuming you know that, so I'm still not sure what you are looking for.
    – schroeder
    Commented Apr 7, 2015 at 23:44
  • Well, being sure is a tough one. You would have to find a point in time when you /trust/ that you are'nt poisoned and monitor for changes from there. Looking at ARP request behavior and try to determine whether or not you still can trust the current state.
    – artifex
    Commented Apr 8, 2015 at 7:15


You must log in to answer this question.

Browse other questions tagged .