I'm writing a program that detects ARP poiosoning.

My question is:

How can I b sure my LAN hasn't been poisoned? Yes, I can use my settings and find the IP address of the default gateway and yes I can get the MAC Address of my gateway and compare it, but both IP and MAC address are easy to spoof.

  • 1
    I'm confused, you are designing a process to detect ARP poisoning, but you need to know the process to detect ARP poisoning? It sort of sounds like you are asking us to create this program for you. – schroeder Apr 7 '15 at 23:20
  • I know how it works. I'm using the IP and MAC address of th gateway to determine if any other packets ARP packets are present with different details, then for sure I'm being snooped. I want to know, since an attacker can change their mac address as well, would there be a better way to determine if the packet's actually coming from the default gateway? – magna_nz Apr 7 '15 at 23:31
  • The simplest way is to look for gratuitous ARP replies, but I'm assuming you know that, so I'm still not sure what you are looking for. – schroeder Apr 7 '15 at 23:44
  • Well, being sure is a tough one. You would have to find a point in time when you /trust/ that you are'nt poisoned and monitor for changes from there. Looking at ARP request behavior and try to determine whether or not you still can trust the current state. – artifex Apr 8 '15 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.