ARP poisoning detection apparatus and method

摘要

the present invention is composed of a wireless LAN environment in the Address Resolution Protocol (Address Resolution Protocol; ARP) attacks the DHCP ( Dynamic Host Configuration Protocol) message to the ARP is the attack detection apparatus and method which can detect an ARP attack by analyzing ARP message. ; The invention DHCP message processor to extract the mapping information to analyze the DHCP message including the IP address and the hardware address of the terminal; ARP message processor to extract the mapping information by analyzing ARP message contains the IP address and the hardware address of the terminal; ARP mapping table storage unit for storing the mapping information in the mapping information of the DHCP message and the ARP message; And if you are new to mapping information and mapping information retrieved from the ARP mapping table storage unit that is extracted from the ARP message includes a mismatched received ARP attack detection to detect an attack. ; ARP in accordance with the present invention can attack detection device can perform accurate existing ARP attack detection without applying the fix for the DHCP server in the environment where the DHCP server is used,.