Real-time detection and recovery of ARP spoofing based on SNMP and WinPcap

摘要

ARP spoofing is a deception within the LAN caused by ARP protocol flaws, which could cause the whole network paralyzed and even worse users' important information stolen through spoofing. The features of ARP is introduced in detail, the update mechanism of ARP mapping table is summarized by ARP spoofing simulation experiment, and the process of ARP spoofing is analyzed. An effective solution which could real-time detect and recover the ARP spoofing is designed by combining SNMP and WinPcap and a software has been developed based on the solution, which succeed in solving the ARP spoofing problem in the campus network.