ARP spoofing attack detection method based on local area network

Abstract

The invention discloses an ARP spoofing attack detection method based on a local area network, and relates to the technical field. The method comprises the following steps: acquiring a data packet byusing a packet capturing tool and analyzing the data packet to obtain MAC and IP pairs of a destination and a source address of the data packet; independently monitoring a port corresponding to the unreasonable MAC address; detecting MAC and IP mapping pairs in the response packet, and judging whether mapping of a source address in the response packet is reasonable or not within a certain period of time; and when the mapping of the source address in the packet is unreasonable, finding a port corresponding to the switch by using the MAC address, and quickly finding out the fraud host. Accordingto the packet capturing tool, an ARP detection system is realized. In cooperation with the port mirroring technology, the static IP is used for carrying out bidirectional binding on the MAC and the IP under the condition that the IPV4 protocol is not changed, meanwhile, the VLAN is used for reducing the local area network, the retrieval efficiency is improved, the ARP deception defense efficiencyis improved, and the burden generated to the network is avoided.

Description

technical field [0001] The invention belongs to the technical field of network communication, in particular to a local area network-based ARP deception attack detection method. Background technique [0002] Address Resolution Protocol (ARP, Address Resolution Protocol) is a TCP / IP sub-protocol for obtaining a physical address based on an IP address. When the host sends information, it broadcasts the ARP request containing the target IP address to all hosts on the network, and receives the return message to determine the physical address of the target; after receiving the return message, store the IP address and physical address in the local ARP In the cache and keep it for a certain period of time, the next request will directly query the ARP cache to save resources. The address resolution protocol is based on the mutual trust of each host in the network. A host on the network can send an ARP reply message independently. When other hosts receive the reply message, they will...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to provide a method for detecting ARP spoofing attacks based on a local area network. The ARP detection system is realized through a packet capture tool, and the port mirroring technology is used to bind MAC and IP bidirectionally with static IP without changing the IPV4 protocol. At the same time, VLAN is used to reduce the local area network, improve retrieval efficiency, and solve the problem of low efficiency of defense against ARP spoofing and heavy burden on the network

Images