Computer NetworksARP Security

ARP Security: Threats, Attacks, and Defenses

LevelIntermediate

Duration90 mins

TopicARP Security

4 / 5

ARP Security Measures: Defense Strategies and Implementation

Building a Defense-in-Depth Architecture

Having explored the attack surface—ARP spoofing, cache poisoning, and the devastating MITM capabilities they enable—we now turn to defense. Protecting against ARP-based attacks requires a defense-in-depth approach, layering multiple security controls that compensate for each other's weaknesses.

No single control completely eliminates ARP vulnerabilities. The protocol's fundamental design cannot be changed without breaking backward compatibility. Instead, we build protection through:

Host-level controls — Static ARP entries, ARP monitoring software, endpoint protection
Switch-level controls — Port security, DHCP snooping, Dynamic ARP Inspection
Network architecture — VLANs, private VLANs, network segmentation
Detection and response — Monitoring, alerting, incident response procedures

This page covers practical implementation of each layer, providing configuration examples and deployment guidance for enterprise environments.

Learning Objectives

By mastering this page, you will understand: (1) static ARP entry configuration and management, (2) VLAN and private VLAN isolation techniques, (3) switch port security implementation, (4) DHCP snooping as a foundation for DAI, (5) host-based protection tools and configurations, and (6) comprehensive security architecture design.

Implementation Complexity

ARP security measures often have operational implications. Static ARP breaks dynamic IP assignment. Port security can block legitimate devices. Incorrect DAI configuration causes network outages. Each measure requires careful planning, testing, and monitoring. Never deploy without understanding the operational impact.

Static ARP Entries

The most direct defense against ARP spoofing is static ARP entries. By manually configuring IP-to-MAC mappings that never change, you eliminate the dynamic update vulnerability entirely.

How Static ARP Works:

Normally, ARP entries are learned dynamically:

Device needs to communicate with IP
Device sends ARP request
Device receives ARP reply
Device caches the mapping
Attackers can send fake replies

With static ARP:

Administrator configures the mapping
Device uses configured mapping
Device ignores ARP replies for that IP
Attackers cannot override the entry

Ideal Use Cases:

Static ARP Deployment Scenarios
Device Type	Recommended?	Rationale
Default Gateway	✓ Strongly Recommended	Highest-value target; protects all outbound traffic
DNS Servers	✓ Strongly Recommended	Prevents DNS spoofing via MITM
Domain Controllers	✓ Strongly Recommended	Protects authentication infrastructure
File Servers	✓ Recommended	Protects sensitive data access
User Workstations	△ Situational	Management overhead often prohibitive
DHCP-assigned devices	✗ Not Recommended	IP changes break static entries
Mobile/Transient devices	✗ Not Recommended	Cannot maintain consistency

Implementation Across Operating Systems:

static_arp_config
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# ================================================
# Linux: Static ARP Configuration
# ================================================
 
# Add static ARP entry (temporary - lost on reboot)
sudo arp -s 192.168.1.1 00:1a:2b:3c:4d:5e
 
# Or using ip command (preferred modern method)
sudo ip neigh add 192.168.1.1 lladdr 00:1a:2b:3c:4d:5e dev eth0 nud permanent
 
# Verify the entry
ip neigh show | grep 192.168.1.1
# Output: 192.168.1.1 dev eth0 lladdr 00:1a:2b:3c:4d:5e PERMANENT
 
# ================================================
# Make Static ARP Persistent Across Reboots
# ================================================
 
# Method 1: /etc/network/interfaces (Debian/Ubuntu)
cat >> /etc/network/interfaces << 'EOF'
auto eth0
iface eth0 inet dhcp
    post-up ip neigh add 192.168.1.1 lladdr 00:1a:2b:3c:4d:5e dev eth0 nud permanent
    post-up ip neigh add 192.168.1.2 lladdr 00:1a:2b:3c:4d:5f dev eth0 nud permanent
EOF
 
# Method 2: NetworkManager dispatcher script
cat > /etc/NetworkManager/dispatcher.d/99-static-arp << 'EOF'
#!/bin/bash
if [ "$1" = "eth0" ] && [ "$2" = "up" ]; then
    ip neigh replace 192.168.1.1 lladdr 00:1a:2b:3c:4d:5e dev eth0 nud permanent
    ip neigh replace 192.168.1.2 lladdr 00:1a:2b:3c:4d:5f dev eth0 nud permanent
fi
EOF
chmod +x /etc/NetworkManager/dispatcher.d/99-static-arp
 
# Method 3: Systemd service
cat > /etc/systemd/system/static-arp.service << 'EOF'
[Unit]
Description=Configure Static ARP Entries
After=network-online.target
Wants=network-online.target
 
[Service]
Type=oneshot
ExecStart=/sbin/ip neigh add 192.168.1.1 lladdr 00:1a:2b:3c:4d:5e dev eth0 nud permanent
ExecStart=/sbin/ip neigh add 192.168.1.2 lladdr 00:1a:2b:3c:4d:5f dev eth0 nud permanent
RemainAfterExit=yes
 
[Install]
WantedBy=multi-user.target
EOF
systemctl enable static-arp.service
 
# ================================================
# Remove Static ARP Entry
# ================================================
sudo ip neigh del 192.168.1.1 dev eth0
 
# Flush all non-permanent entries
ip neigh flush nud stale
ip neigh flush nud reachable

Automation is Key

Manual static ARP management doesn't scale. Use configuration management (Ansible, Puppet, Group Policy) to deploy and maintain static entries across your infrastructure. Implement monitoring to detect when actual MAC addresses don't match configured static entries—this indicates hardware changes or spoofing attempts.

VLAN Isolation and Private VLANs

ARP operates within a broadcast domain. By reducing broadcast domain size through VLANs, you limit the scope of ARP-based attacks. Private VLANs (PVLANs) take this further by restricting communication between hosts even within the same VLAN.

Basic VLAN Segmentation:

Separating different host types into different VLANs:

Attackers can only poison hosts in their own VLAN
Critical infrastructure isolated from general users
Compromise in one VLAN doesn't automatically spread

Recommended VLAN Segmentation:

VLAN Segmentation Strategy
VLAN	Purpose	Security Benefit
Management VLAN	Network device management	Isolates infrastructure from user attacks
Server VLAN	Production servers	Limits lateral movement from workstations
User VLAN(s)	End-user workstations	Contains user-to-user attacks
Guest VLAN	Visitor devices	Isolates untrusted devices
IoT VLAN	IoT/OT devices	Protects vulnerable devices
Voice VLAN	VoIP phones	Protects communications

Private VLANs (PVLANs):

PVLANs provide port-level isolation within a VLAN. They create sub-VLANs with restricted communication patterns:

PVLAN Port Types:

Promiscuous Port — Can communicate with all other ports (typically gateway/router)
Isolated Port — Can only communicate with promiscuous ports
Community Port — Can communicate with same community and promiscuous ports

PVLAN Use Case:

In a web hosting environment:

Each customer server is on an isolated port
Customer A cannot attack Customer B (same VLAN doesn't matter)
Both can access the gateway (promiscuous port)
ARP spoofing between customers is impossible

Converting Mermaid diagram...

pvlan_config

Cisco IOS

! ================================================
! Private VLAN Configuration (Cisco IOS)
! ================================================
 
! Enable VTP transparent mode (required for PVLAN)
vtp mode transparent
 
! Define Secondary VLANs
vlan 101
  name ISOLATED-SERVERS
  private-vlan isolated
 
vlan 102
  name COMMUNITY-WEB
  private-vlan community
 
vlan 103
  name COMMUNITY-DB
  private-vlan community
 
! Define Primary VLAN and associate secondary VLANs
vlan 100
  name PRIMARY-DATACENTER
  private-vlan primary
  private-vlan association 101,102,103
 
! ================================================
! Configure Switch Ports
! ================================================
 
! Promiscuous port (gateway interface)
interface GigabitEthernet0/1
  description Gateway - Promiscuous
  switchport mode private-vlan promiscuous
  switchport private-vlan mapping 100 101,102,103
 
! Isolated port (single customer server)
interface GigabitEthernet0/2
  description Customer1 - Isolated
  switchport mode private-vlan host
  switchport private-vlan host-association 100 101
 
! Community port (web server cluster)
interface GigabitEthernet0/3
  description WebServer1 - Community
  switchport mode private-vlan host
  switchport private-vlan host-association 100 102
 
interface GigabitEthernet0/4
  description WebServer2 - Community  
  switchport mode private-vlan host
  switchport private-vlan host-association 100 102
 
! ================================================
! Verification Commands
! ================================================
show vlan private-vlan
show vlan private-vlan type
show interfaces switchport | include private-vlan
show interfaces private-vlan mapping
 
! ================================================
! Security Result:
! - Isolated ports CANNOT send/receive to each other
! - Community ports can talk within same community
! - All ports can access promiscuous port (gateway)
! - ARP spoofing between isolated ports: IMPOSSIBLE
! ================================================

PVLAN Limitations

PVLANs don't protect the promiscuous port. An attacker with access to the gateway can still intercept traffic. PVLANs work best in combination with other controls on the gateway, such as DAI and static ARP.

Switch Port Security

Port Security limits which MAC addresses can send traffic through a switch port. While primarily designed to prevent unauthorized device connections, it also limits ARP spoofing by restricting the source MACs an attacker can use.

How Port Security Helps:

For ARP spoofing to work, the attacker must:

Send ARP packets claiming to be another IP
Use their own MAC address (where traffic should go)

With port security:

Each port allows only specific/learned MAC addresses
Attacker cannot easily use a spoofed MAC
Attacker's real MAC is what receives the traffic
Security violation occurs if attacker tries MAC spoofing

Port Security Modes:

Port Security Violation Modes
Mode	Behavior on Violation	Alerting	Port Status
Protect	Drop packets from violating MAC	No	Port stays up
Restrict	Drop packets, increment counter, log	Yes (logging)	Port stays up
Shutdown	Error-disable the port	Yes (SNMP trap)	Port disabled

port_security_config

Cisco IOS

! ================================================
! Port Security Configuration (Cisco IOS)
! ================================================
 
! Basic port security on access port
interface GigabitEthernet0/1
  description User Workstation
  switchport mode access
  switchport access vlan 10
  
  ! Enable port security
  switchport port-security
  
  ! Maximum MAC addresses allowed (default is 1)
  switchport port-security maximum 2
  
  ! Violation action
  switchport port-security violation restrict
  
  ! Learn MAC addresses dynamically and make sticky
  switchport port-security mac-address sticky
  
  ! Or specify MAC address statically
  ! switchport port-security mac-address 0000.1234.5678
 
! ================================================
! Advanced Configuration with Aging
! ================================================
 
interface GigabitEthernet0/2
  switchport mode access
  switchport access vlan 10
  switchport port-security
  switchport port-security maximum 3
  switchport port-security violation shutdown
  switchport port-security mac-address sticky
  
  ! Aging configuration
  switchport port-security aging time 60
  switchport port-security aging type inactivity
 
! ================================================
! Verification Commands
! ================================================
 
! View port security status
show port-security
 
! Detailed status for specific interface
show port-security interface GigabitEthernet0/1
 
! View secure MAC addresses
show port-security address
 
! View security violations
show interfaces status err-disabled
 
! ================================================
! Recover from Violation (Shutdown Mode)
! ================================================
 
! Manual recovery
interface GigabitEthernet0/1
  shutdown
  no shutdown
 
! Or enable automatic recovery (globally)
errdisable recovery cause psecure-violation
errdisable recovery interval 300  ! 5 minutes
 
! ================================================
! Recommended Configuration for Security
! ================================================
 
! Apply to all user access ports via port-channel or macro
interface range GigabitEthernet0/1 - 24
  switchport mode access
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation restrict
  switchport port-security mac-address sticky
  spanning-tree portfast
  spanning-tree bpduguard enable

Port Security Benefits

•Limits MAC addresses per port
•Prevents unauthorized device connections
•Detects MAC address flooding attacks
•Generates alerts on violations
•Works with DAI for comprehensive protection

Port Security Limitations

•Doesn't validate IP-to-MAC binding
•Attacker can still use their real MAC
•Sticky MACs may learn attacker's MAC
•Shutdown mode causes availability issues
•Requires careful tuning to avoid false positives

Port Security + DAI = Strong Protection

Port security alone doesn't prevent ARP spoofing—an attacker can spoof using their own MAC. However, combined with Dynamic ARP Inspection (covered next), you get both MAC validation (port security) and IP-to-MAC binding validation (DAI). Deploy both for comprehensive Layer 2 security.

DHCP Snooping

DHCP Snooping is a critical security feature that, while designed to prevent rogue DHCP servers, also creates the foundation for Dynamic ARP Inspection. DHCP Snooping builds a binding table that maps IP addresses to MAC addresses and switch ports.

How DHCP Snooping Works:

Switch inspects all DHCP traffic
Maintains database of legitimate DHCP bindings
Distinguishes "trusted" and "untrusted" ports
Blocks rogue DHCP server responses on untrusted ports
Records: MAC, IP, VLAN, Port, Lease Time

The Binding Table:

The DHCP snooping binding table becomes the source of truth for IP-to-MAC mappings. Dynamic ARP Inspection uses this table to validate ARP packets.

Converting Mermaid diagram...

dhcp_snooping_config

Cisco IOS

! ================================================
! DHCP Snooping Configuration (Cisco IOS)
! ================================================
 
! Enable DHCP snooping globally
ip dhcp snooping
 
! Enable for specific VLANs
ip dhcp snooping vlan 10,20,30
 
! Verify DHCP snooping options (insert option 82)
ip dhcp snooping information option
 
! ================================================
! Configure Trusted and Untrusted Ports
! ================================================
 
! Uplink to DHCP server - TRUSTED
interface GigabitEthernet0/1
  description Uplink to DHCP Server
  ip dhcp snooping trust
 
! User access ports - UNTRUSTED (default)
interface range GigabitEthernet0/2 - 24
  description User Access Ports
  ! Untrusted is default, but explicit is good
  no ip dhcp snooping trust
  
  ! Rate limit DHCP packets (prevent DoS)
  ip dhcp snooping limit rate 15
 
! ================================================
! Binding Table Management
! ================================================
 
! View current bindings
show ip dhcp snooping binding
 
! View binding statistics
show ip dhcp snooping statistics
 
! Save bindings to flash (persist across reboot)
ip dhcp snooping database flash:dhcp-snooping.db
! Or to external server
ip dhcp snooping database tftp://server/dhcp-snooping.db
ip dhcp snooping database write-delay 60
 
! Manually add binding (for static IP hosts)
ip dhcp snooping binding 0000.1234.5678 vlan 10 192.168.10.50 interface Gi0/2 expiry 86400
 
! ================================================
! Verification
! ================================================
show ip dhcp snooping
show ip dhcp snooping binding
show ip dhcp snooping database
show ip dhcp snooping statistics
 
! ================================================
! Example Binding Table Output:
! ================================================
! MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
! ------------------  ---------------  ----------  -------------  ----  ----------
! 00:1A:2B:3C:4D:5E   192.168.10.50    86400       dhcp-snooping  10    Gi0/2
! 00:1A:2B:3C:4D:5F   192.168.10.51    86400       dhcp-snooping  10    Gi0/3
!
! This table is used by Dynamic ARP Inspection to validate ARP packets

Static IP Consideration

DHCP Snooping only learns bindings from DHCP traffic. Hosts with static IPs won't appear in the binding table. For static IP hosts, manually add bindings, or they will be blocked when DAI is enabled. This is a common deployment error that causes network outages.

DHCP Snooping as DAI Foundation:

The connection between DHCP Snooping and Dynamic ARP Inspection:

DHCP Snooping builds binding table: MAC ↔ IP ↔ Port ↔ VLAN
Client receives IP via DHCP, binding recorded
DAI intercepts all ARP packets on untrusted ports
DAI checks: "Does this ARP packet match a known binding?"
If yes: forward the packet
If no: drop the packet, log violation

Without DHCP Snooping, DAI has no reference database. You must enable DHCP Snooping before DAI can work.

Host-Based Protections

Beyond network infrastructure controls, individual hosts can implement protections against ARP attacks. These host-based measures provide defense-in-depth, especially valuable when network-level controls aren't available.

Host-Based Defense Categories:

ARP Cache Protection — Preventing cache poisoning
ARP Monitoring — Detecting spoofing attempts
Encryption — Rendering interception useless
Authentication — Validating communication partners

linux_arp_protection.sh
Bash
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
#!/bin/bash
# ================================================
# Linux Host ARP Protection Configuration
# ================================================
 
# 1. ARP Cache Hardening
# ================================================
 
# Disable accepting gratuitous ARP (unsolicited updates)
sysctl -w net.ipv4.conf.all.arp_accept=0
sysctl -w net.ipv4.conf.default.arp_accept=0
 
# Enable ARP validation
# 0 = no validation (default)
# 1 = validate source IP on all interfaces
# 2 = validate source IP on receiving interface
# 3 = validate both source and target IP
sysctl -w net.ipv4.conf.all.arp_validate=1
echo "net.ipv4.conf.all.arp_validate = 1" >> /etc/sysctl.conf
 
# Ignore ARP replies that don't match requests
sysctl -w net.ipv4.conf.all.arp_ignore=1
 
# Reduce cache timeout (faster recovery from poisoning)
sysctl -w net.ipv4.neigh.default.base_reachable_time_ms=15000
 
# 2. Static ARP for Critical Hosts
# ================================================
# Add permanent entries for gateway and critical servers
ip neigh add 192.168.1.1 lladdr 00:1a:2b:3c:4d:5e dev eth0 nud permanent
ip neigh add 192.168.1.2 lladdr 00:1a:2b:3c:4d:5f dev eth0 nud permanent
 
# 3. ArpWatch - Monitor for Changes
# ================================================
# Install arpwatch
apt install arpwatch -y
 
# Configure arpwatch
cat > /etc/arpwatch.conf << 'EOF'
eth0	-a -n 192.168.1.0/24 -m admin@example.com
EOF
 
# Enable and start
systemctl enable arpwatch
systemctl start arpwatch
 
# View arpwatch database
arpwatch -d
 
# 4. Arpon - Active ARP Inspection
# ================================================
# ArpOn daemon provides active protection
 
# Install
apt install arpon -y
 
# Configure for SARPI mode (Static ARP Inspection)
cat > /etc/arpon.conf << 'EOF'
# Static ARP table for important hosts
192.168.1.1	00:1a:2b:3c:4d:5e
192.168.1.2	00:1a:2b:3c:4d:5f
EOF
 
# Enable SARPI mode in /etc/default/arpon
sed -i 's/DAEMON_OPTS="-q"/DAEMON_OPTS="-q -g"/' /etc/default/arpon
 
# Start ArpOn
systemctl start arpon
 
# 5. Monitor ARP Cache Changes
# ================================================
# Simple monitoring script
cat > /usr/local/bin/arp-monitor.sh << 'SCRIPT'
#!/bin/bash
GATEWAY="192.168.1.1"
EXPECTED_MAC="00:1a:2b:3c:4d:5e"
 
while true; do
    CURRENT_MAC=$(ip neigh show $GATEWAY | awk '{print $5}')
    if [ "$CURRENT_MAC" != "$EXPECTED_MAC" ]; then
        logger -p auth.alert "ARP SPOOFING DETECTED: $GATEWAY is now $CURRENT_MAC"
        # Optional: Auto-remediation
        ip neigh replace $GATEWAY lladdr $EXPECTED_MAC dev eth0 nud permanent
    fi
    sleep 5
done
SCRIPT
chmod +x /usr/local/bin/arp-monitor.sh

Defense-in-Depth Philosophy

Don't rely on any single protection. Combine static ARP entries, ARP monitoring, network-level DAI, and encryption. Each layer catches what others might miss. An attacker must defeat every layer to succeed—dramatically increasing the difficulty and detection probability.

Summary: ARP Security Measures

Defending against ARP-based attacks requires multiple complementary controls working together. No single measure provides complete protection, but layered defense creates a formidable barrier.

Security Measure Summary:

ARP Security Controls Comparison
Control	Scope	Protection Level	Complexity	Best For
Static ARP	Host	High (for covered IPs)	Low	Critical infrastructure
VLANs	Network	Medium (limits scope)	Medium	Network segmentation
Private VLANs	Network	High (within VLAN)	High	Shared hosting, multi-tenant
Port Security	Switch Port	Low-Medium	Medium	Unauthorized devices
DHCP Snooping	Switch/VLAN	Medium (enables DAI)	Medium	Foundation for DAI
DAI	Switch/VLAN	High	High	Comprehensive protection
Host Tools	Host	Medium-High	Low-Medium	When network controls unavailable
Encryption	End-to-End	Very High	Varies	Sensitive communications

Key Takeaways

•Static ARP protects critical infrastructure — Deploy for gateways, DNS, DCs, and critical servers. Requires management but provides strong protection.
•VLANs limit attack scope — Proper segmentation contains attacks within a broadcast domain. PVLANs provide isolation within VLANs.
•Port security alone isn't enough — Limits MAC addresses but doesn't validate IP-to-MAC bindings. Must combine with DAI.
•DHCP Snooping enables DAI — Builds the binding database that DAI uses for validation. Required prerequisite for DAI.
•Host-based tools provide local protection — Valuable when network controls aren't available or as additional layer.
•Encryption renders interception useless — The ultimate protection—even successful MITM yields only encrypted data.

What's Next:

The final page of this module provides a deep dive into Dynamic ARP Inspection (DAI)—the most comprehensive network-level defense against ARP attacks. We'll cover DAI architecture, configuration, tuning, and operational considerations for enterprise deployment.

Page Complete

You now understand the spectrum of ARP security measures—from host-level static entries through switch-based port security, VLAN isolation, DHCP snooping, and host protection tools. This foundation prepares you for implementing Dynamic ARP Inspection, the enterprise-grade solution covered next.

4 / 5

Loading learning content...

Computer NetworksARP Security

ARP Security: Threats, Attacks, and Defenses

LevelIntermediate

Duration90 mins

TopicARP Security

4 / 5

ARP Security Measures: Defense Strategies and Implementation

Building a Defense-in-Depth Architecture

No single control completely eliminates ARP vulnerabilities. The protocol's fundamental design cannot be changed without breaking backward compatibility. Instead, we build protection through:

Host-level controls — Static ARP entries, ARP monitoring software, endpoint protection
Switch-level controls — Port security, DHCP snooping, Dynamic ARP Inspection
Network architecture — VLANs, private VLANs, network segmentation
Detection and response — Monitoring, alerting, incident response procedures

This page covers practical implementation of each layer, providing configuration examples and deployment guidance for enterprise environments.

Learning Objectives

Implementation Complexity

Static ARP Entries

The most direct defense against ARP spoofing is static ARP entries. By manually configuring IP-to-MAC mappings that never change, you eliminate the dynamic update vulnerability entirely.

How Static ARP Works:

Normally, ARP entries are learned dynamically:

Device needs to communicate with IP
Device sends ARP request
Device receives ARP reply
Device caches the mapping
Attackers can send fake replies

With static ARP:

Administrator configures the mapping
Device uses configured mapping
Device ignores ARP replies for that IP
Attackers cannot override the entry

Ideal Use Cases:

Static ARP Deployment Scenarios
Device Type	Recommended?	Rationale
Default Gateway	✓ Strongly Recommended	Highest-value target; protects all outbound traffic
DNS Servers	✓ Strongly Recommended	Prevents DNS spoofing via MITM
Domain Controllers	✓ Strongly Recommended	Protects authentication infrastructure
File Servers	✓ Recommended	Protects sensitive data access
User Workstations	△ Situational	Management overhead often prohibitive
DHCP-assigned devices	✗ Not Recommended	IP changes break static entries
Mobile/Transient devices	✗ Not Recommended	Cannot maintain consistency

Implementation Across Operating Systems:

static_arp_config
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# ================================================
# Linux: Static ARP Configuration
# ================================================
 
# Add static ARP entry (temporary - lost on reboot)
sudo arp -s 192.168.1.1 00:1a:2b:3c:4d:5e
 
# Or using ip command (preferred modern method)
sudo ip neigh add 192.168.1.1 lladdr 00:1a:2b:3c:4d:5e dev eth0 nud permanent
 
# Verify the entry
ip neigh show | grep 192.168.1.1
# Output: 192.168.1.1 dev eth0 lladdr 00:1a:2b:3c:4d:5e PERMANENT
 
# ================================================
# Make Static ARP Persistent Across Reboots
# ================================================
 
# Method 1: /etc/network/interfaces (Debian/Ubuntu)
cat >> /etc/network/interfaces << 'EOF'
auto eth0
iface eth0 inet dhcp
    post-up ip neigh add 192.168.1.1 lladdr 00:1a:2b:3c:4d:5e dev eth0 nud permanent
    post-up ip neigh add 192.168.1.2 lladdr 00:1a:2b:3c:4d:5f dev eth0 nud permanent
EOF
 
# Method 2: NetworkManager dispatcher script
cat > /etc/NetworkManager/dispatcher.d/99-static-arp << 'EOF'
#!/bin/bash
if [ "$1" = "eth0" ] && [ "$2" = "up" ]; then
    ip neigh replace 192.168.1.1 lladdr 00:1a:2b:3c:4d:5e dev eth0 nud permanent
    ip neigh replace 192.168.1.2 lladdr 00:1a:2b:3c:4d:5f dev eth0 nud permanent
fi
EOF
chmod +x /etc/NetworkManager/dispatcher.d/99-static-arp
 
# Method 3: Systemd service
cat > /etc/systemd/system/static-arp.service << 'EOF'
[Unit]
Description=Configure Static ARP Entries
After=network-online.target
Wants=network-online.target
 
[Service]
Type=oneshot
ExecStart=/sbin/ip neigh add 192.168.1.1 lladdr 00:1a:2b:3c:4d:5e dev eth0 nud permanent
ExecStart=/sbin/ip neigh add 192.168.1.2 lladdr 00:1a:2b:3c:4d:5f dev eth0 nud permanent
RemainAfterExit=yes
 
[Install]
WantedBy=multi-user.target
EOF
systemctl enable static-arp.service
 
# ================================================
# Remove Static ARP Entry
# ================================================
sudo ip neigh del 192.168.1.1 dev eth0
 
# Flush all non-permanent entries
ip neigh flush nud stale
ip neigh flush nud reachable

Automation is Key

VLAN Isolation and Private VLANs

Basic VLAN Segmentation:

Separating different host types into different VLANs:

Attackers can only poison hosts in their own VLAN
Critical infrastructure isolated from general users
Compromise in one VLAN doesn't automatically spread

Recommended VLAN Segmentation:

VLAN Segmentation Strategy
VLAN	Purpose	Security Benefit
Management VLAN	Network device management	Isolates infrastructure from user attacks
Server VLAN	Production servers	Limits lateral movement from workstations
User VLAN(s)	End-user workstations	Contains user-to-user attacks
Guest VLAN	Visitor devices	Isolates untrusted devices
IoT VLAN	IoT/OT devices	Protects vulnerable devices
Voice VLAN	VoIP phones	Protects communications

Private VLANs (PVLANs):

PVLANs provide port-level isolation within a VLAN. They create sub-VLANs with restricted communication patterns:

PVLAN Port Types:

Promiscuous Port — Can communicate with all other ports (typically gateway/router)
Isolated Port — Can only communicate with promiscuous ports
Community Port — Can communicate with same community and promiscuous ports

PVLAN Use Case:

In a web hosting environment:

Each customer server is on an isolated port
Customer A cannot attack Customer B (same VLAN doesn't matter)
Both can access the gateway (promiscuous port)
ARP spoofing between customers is impossible

Converting Mermaid diagram...

pvlan_config

Cisco IOS

! ================================================
! Private VLAN Configuration (Cisco IOS)
! ================================================
 
! Enable VTP transparent mode (required for PVLAN)
vtp mode transparent
 
! Define Secondary VLANs
vlan 101
  name ISOLATED-SERVERS
  private-vlan isolated
 
vlan 102
  name COMMUNITY-WEB
  private-vlan community
 
vlan 103
  name COMMUNITY-DB
  private-vlan community
 
! Define Primary VLAN and associate secondary VLANs
vlan 100
  name PRIMARY-DATACENTER
  private-vlan primary
  private-vlan association 101,102,103
 
! ================================================
! Configure Switch Ports
! ================================================
 
! Promiscuous port (gateway interface)
interface GigabitEthernet0/1
  description Gateway - Promiscuous
  switchport mode private-vlan promiscuous
  switchport private-vlan mapping 100 101,102,103
 
! Isolated port (single customer server)
interface GigabitEthernet0/2
  description Customer1 - Isolated
  switchport mode private-vlan host
  switchport private-vlan host-association 100 101
 
! Community port (web server cluster)
interface GigabitEthernet0/3
  description WebServer1 - Community
  switchport mode private-vlan host
  switchport private-vlan host-association 100 102
 
interface GigabitEthernet0/4
  description WebServer2 - Community  
  switchport mode private-vlan host
  switchport private-vlan host-association 100 102
 
! ================================================
! Verification Commands
! ================================================
show vlan private-vlan
show vlan private-vlan type
show interfaces switchport | include private-vlan
show interfaces private-vlan mapping
 
! ================================================
! Security Result:
! - Isolated ports CANNOT send/receive to each other
! - Community ports can talk within same community
! - All ports can access promiscuous port (gateway)
! - ARP spoofing between isolated ports: IMPOSSIBLE
! ================================================

PVLAN Limitations

Switch Port Security

How Port Security Helps:

For ARP spoofing to work, the attacker must:

Send ARP packets claiming to be another IP
Use their own MAC address (where traffic should go)

With port security:

Each port allows only specific/learned MAC addresses
Attacker cannot easily use a spoofed MAC
Attacker's real MAC is what receives the traffic
Security violation occurs if attacker tries MAC spoofing

Port Security Modes:

Port Security Violation Modes
Mode	Behavior on Violation	Alerting	Port Status
Protect	Drop packets from violating MAC	No	Port stays up
Restrict	Drop packets, increment counter, log	Yes (logging)	Port stays up
Shutdown	Error-disable the port	Yes (SNMP trap)	Port disabled

port_security_config

Cisco IOS

! ================================================
! Port Security Configuration (Cisco IOS)
! ================================================
 
! Basic port security on access port
interface GigabitEthernet0/1
  description User Workstation
  switchport mode access
  switchport access vlan 10
  
  ! Enable port security
  switchport port-security
  
  ! Maximum MAC addresses allowed (default is 1)
  switchport port-security maximum 2
  
  ! Violation action
  switchport port-security violation restrict
  
  ! Learn MAC addresses dynamically and make sticky
  switchport port-security mac-address sticky
  
  ! Or specify MAC address statically
  ! switchport port-security mac-address 0000.1234.5678
 
! ================================================
! Advanced Configuration with Aging
! ================================================
 
interface GigabitEthernet0/2
  switchport mode access
  switchport access vlan 10
  switchport port-security
  switchport port-security maximum 3
  switchport port-security violation shutdown
  switchport port-security mac-address sticky
  
  ! Aging configuration
  switchport port-security aging time 60
  switchport port-security aging type inactivity
 
! ================================================
! Verification Commands
! ================================================
 
! View port security status
show port-security
 
! Detailed status for specific interface
show port-security interface GigabitEthernet0/1
 
! View secure MAC addresses
show port-security address
 
! View security violations
show interfaces status err-disabled
 
! ================================================
! Recover from Violation (Shutdown Mode)
! ================================================
 
! Manual recovery
interface GigabitEthernet0/1
  shutdown
  no shutdown
 
! Or enable automatic recovery (globally)
errdisable recovery cause psecure-violation
errdisable recovery interval 300  ! 5 minutes
 
! ================================================
! Recommended Configuration for Security
! ================================================
 
! Apply to all user access ports via port-channel or macro
interface range GigabitEthernet0/1 - 24
  switchport mode access
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation restrict
  switchport port-security mac-address sticky
  spanning-tree portfast
  spanning-tree bpduguard enable

Port Security Benefits

•Limits MAC addresses per port
•Prevents unauthorized device connections
•Detects MAC address flooding attacks
•Generates alerts on violations
•Works with DAI for comprehensive protection

Port Security Limitations

•Doesn't validate IP-to-MAC binding
•Attacker can still use their real MAC
•Sticky MACs may learn attacker's MAC
•Shutdown mode causes availability issues
•Requires careful tuning to avoid false positives

Port Security + DAI = Strong Protection

DHCP Snooping

How DHCP Snooping Works:

Switch inspects all DHCP traffic
Maintains database of legitimate DHCP bindings
Distinguishes "trusted" and "untrusted" ports
Blocks rogue DHCP server responses on untrusted ports
Records: MAC, IP, VLAN, Port, Lease Time

The Binding Table:

The DHCP snooping binding table becomes the source of truth for IP-to-MAC mappings. Dynamic ARP Inspection uses this table to validate ARP packets.

Converting Mermaid diagram...

dhcp_snooping_config

Cisco IOS

! ================================================
! DHCP Snooping Configuration (Cisco IOS)
! ================================================
 
! Enable DHCP snooping globally
ip dhcp snooping
 
! Enable for specific VLANs
ip dhcp snooping vlan 10,20,30
 
! Verify DHCP snooping options (insert option 82)
ip dhcp snooping information option
 
! ================================================
! Configure Trusted and Untrusted Ports
! ================================================
 
! Uplink to DHCP server - TRUSTED
interface GigabitEthernet0/1
  description Uplink to DHCP Server
  ip dhcp snooping trust
 
! User access ports - UNTRUSTED (default)
interface range GigabitEthernet0/2 - 24
  description User Access Ports
  ! Untrusted is default, but explicit is good
  no ip dhcp snooping trust
  
  ! Rate limit DHCP packets (prevent DoS)
  ip dhcp snooping limit rate 15
 
! ================================================
! Binding Table Management
! ================================================
 
! View current bindings
show ip dhcp snooping binding
 
! View binding statistics
show ip dhcp snooping statistics
 
! Save bindings to flash (persist across reboot)
ip dhcp snooping database flash:dhcp-snooping.db
! Or to external server
ip dhcp snooping database tftp://server/dhcp-snooping.db
ip dhcp snooping database write-delay 60
 
! Manually add binding (for static IP hosts)
ip dhcp snooping binding 0000.1234.5678 vlan 10 192.168.10.50 interface Gi0/2 expiry 86400
 
! ================================================
! Verification
! ================================================
show ip dhcp snooping
show ip dhcp snooping binding
show ip dhcp snooping database
show ip dhcp snooping statistics
 
! ================================================
! Example Binding Table Output:
! ================================================
! MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
! ------------------  ---------------  ----------  -------------  ----  ----------
! 00:1A:2B:3C:4D:5E   192.168.10.50    86400       dhcp-snooping  10    Gi0/2
! 00:1A:2B:3C:4D:5F   192.168.10.51    86400       dhcp-snooping  10    Gi0/3
!
! This table is used by Dynamic ARP Inspection to validate ARP packets

Static IP Consideration

DHCP Snooping as DAI Foundation:

The connection between DHCP Snooping and Dynamic ARP Inspection:

DHCP Snooping builds binding table: MAC ↔ IP ↔ Port ↔ VLAN
Client receives IP via DHCP, binding recorded
DAI intercepts all ARP packets on untrusted ports
DAI checks: "Does this ARP packet match a known binding?"
If yes: forward the packet
If no: drop the packet, log violation

Without DHCP Snooping, DAI has no reference database. You must enable DHCP Snooping before DAI can work.

Host-Based Protections

Host-Based Defense Categories:

ARP Cache Protection — Preventing cache poisoning
ARP Monitoring — Detecting spoofing attempts
Encryption — Rendering interception useless
Authentication — Validating communication partners

linux_arp_protection.sh
Bash
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
#!/bin/bash
# ================================================
# Linux Host ARP Protection Configuration
# ================================================
 
# 1. ARP Cache Hardening
# ================================================
 
# Disable accepting gratuitous ARP (unsolicited updates)
sysctl -w net.ipv4.conf.all.arp_accept=0
sysctl -w net.ipv4.conf.default.arp_accept=0
 
# Enable ARP validation
# 0 = no validation (default)
# 1 = validate source IP on all interfaces
# 2 = validate source IP on receiving interface
# 3 = validate both source and target IP
sysctl -w net.ipv4.conf.all.arp_validate=1
echo "net.ipv4.conf.all.arp_validate = 1" >> /etc/sysctl.conf
 
# Ignore ARP replies that don't match requests
sysctl -w net.ipv4.conf.all.arp_ignore=1
 
# Reduce cache timeout (faster recovery from poisoning)
sysctl -w net.ipv4.neigh.default.base_reachable_time_ms=15000
 
# 2. Static ARP for Critical Hosts
# ================================================
# Add permanent entries for gateway and critical servers
ip neigh add 192.168.1.1 lladdr 00:1a:2b:3c:4d:5e dev eth0 nud permanent
ip neigh add 192.168.1.2 lladdr 00:1a:2b:3c:4d:5f dev eth0 nud permanent
 
# 3. ArpWatch - Monitor for Changes
# ================================================
# Install arpwatch
apt install arpwatch -y
 
# Configure arpwatch
cat > /etc/arpwatch.conf << 'EOF'
eth0	-a -n 192.168.1.0/24 -m admin@example.com
EOF
 
# Enable and start
systemctl enable arpwatch
systemctl start arpwatch
 
# View arpwatch database
arpwatch -d
 
# 4. Arpon - Active ARP Inspection
# ================================================
# ArpOn daemon provides active protection
 
# Install
apt install arpon -y
 
# Configure for SARPI mode (Static ARP Inspection)
cat > /etc/arpon.conf << 'EOF'
# Static ARP table for important hosts
192.168.1.1	00:1a:2b:3c:4d:5e
192.168.1.2	00:1a:2b:3c:4d:5f
EOF
 
# Enable SARPI mode in /etc/default/arpon
sed -i 's/DAEMON_OPTS="-q"/DAEMON_OPTS="-q -g"/' /etc/default/arpon
 
# Start ArpOn
systemctl start arpon
 
# 5. Monitor ARP Cache Changes
# ================================================
# Simple monitoring script
cat > /usr/local/bin/arp-monitor.sh << 'SCRIPT'
#!/bin/bash
GATEWAY="192.168.1.1"
EXPECTED_MAC="00:1a:2b:3c:4d:5e"
 
while true; do
    CURRENT_MAC=$(ip neigh show $GATEWAY | awk '{print $5}')
    if [ "$CURRENT_MAC" != "$EXPECTED_MAC" ]; then
        logger -p auth.alert "ARP SPOOFING DETECTED: $GATEWAY is now $CURRENT_MAC"
        # Optional: Auto-remediation
        ip neigh replace $GATEWAY lladdr $EXPECTED_MAC dev eth0 nud permanent
    fi
    sleep 5
done
SCRIPT
chmod +x /usr/local/bin/arp-monitor.sh

Defense-in-Depth Philosophy

Summary: ARP Security Measures

Defending against ARP-based attacks requires multiple complementary controls working together. No single measure provides complete protection, but layered defense creates a formidable barrier.

Security Measure Summary:

ARP Security Controls Comparison
Control	Scope	Protection Level	Complexity	Best For
Static ARP	Host	High (for covered IPs)	Low	Critical infrastructure
VLANs	Network	Medium (limits scope)	Medium	Network segmentation
Private VLANs	Network	High (within VLAN)	High	Shared hosting, multi-tenant
Port Security	Switch Port	Low-Medium	Medium	Unauthorized devices
DHCP Snooping	Switch/VLAN	Medium (enables DAI)	Medium	Foundation for DAI
DAI	Switch/VLAN	High	High	Comprehensive protection
Host Tools	Host	Medium-High	Low-Medium	When network controls unavailable
Encryption	End-to-End	Very High	Varies	Sensitive communications

Key Takeaways

•Static ARP protects critical infrastructure — Deploy for gateways, DNS, DCs, and critical servers. Requires management but provides strong protection.
•VLANs limit attack scope — Proper segmentation contains attacks within a broadcast domain. PVLANs provide isolation within VLANs.
•Port security alone isn't enough — Limits MAC addresses but doesn't validate IP-to-MAC bindings. Must combine with DAI.
•DHCP Snooping enables DAI — Builds the binding database that DAI uses for validation. Required prerequisite for DAI.
•Host-based tools provide local protection — Valuable when network controls aren't available or as additional layer.
•Encryption renders interception useless — The ultimate protection—even successful MITM yields only encrypted data.

What's Next:

Page Complete

4 / 5