ARP Spoofing偵測及防護機制

The Study of ARP Spoofing Detection and Protection Mechanism

王宜秀(Yi-Shiou Wang 王宜秀)

指導教授 ： 王永鐘

國立臺北科技大學/電資學院/電機工程系研究所/碩士(2014年)

摘要

Address Resolution Protocol (ARP)是電腦主機用以轉換網路位址(IP Address)至實體位址(MAC address)的網路協定，ARP spoofing則藉由ARP沒有防護機制的弱點而產生的網路攻擊手法，例如在區域網路發動Denial of Service (DoS) 及 Man In The Middle (MITM)攻擊，ARP的缺點所造成的網路攻擊不但可能會癱瘓網路運作，甚至個人資料也會透過ARP spoofing而被竊取。本論文以ARP spoofing軟體為研究對象，分析Arcai Netcut軟體運作原理及其造成的網路影響，並建立一套分散式架構、快速、有效、低成本的自動偵測及防護Arcai Netcut解決方案，本研究整合Command-Line Interface (CLI) 功能及各式Linux scripts，本系統已成功運作於學生宿舍網路及校園網路並有效偵測及防護Arcai Netcut。

關鍵字

ARP spoofing ； DoS ； MITM ； Arcai Netcut

並列摘要

Address Resolution Protocol (ARP) is one of heavily used protocols by computers for mapping network address (IP address) to physical address (MAC address). ARP spoofing is a deception within the LAN caused by ARP flaws, which is used to launch Denial of Service (DoS) and Man In The Middle (MITM) by attackers. ARP flaws could cause the network paralyzed and even worse personal information stolen through ARP spoofing attack. In this paper, we analyzed the process and the effect of the common ARP spoofing software called Arcai Netcut. A distributed, swiftly, effective, and low cost solution, which could automatically detect and defense the Arcai Netcut is implemented on Linux Mini PC. We combined the functions of Command-Line Interface (CLI) and some different Linux scripts to develop the software, which succeed in detecting and defensing the Arcai Netcut in the student dormitory network and campus network.

並列關鍵字

ARP Spoofing ； DoS ； MITM ； Arcai Netcut

參考文獻

[7] M. Oh, Y.-G. Kim, S. Hong, S. Cha, “ASA: agent-based secure ARP cache management,” IET Communacation., vol. 6, no. 7, 2012, pp. 685-693.

[17] S. Puangpronpitag, N. Masusai, “An Efficient and Feasible Solution to ARP Spoof Problem,” IEEE, 2009, pp.2-3.

[18] S. G. Bhirud, V. Katkar, “Light Weight Approach for IP-ARP Spoofing Detection and Prevention,” 2011, pp.3-4.

[1] “Arcai Netcut,” http://arcai.com/

[2] “ARP spoofing,” http://en.wikipedia.org/wiki/ARP_spoofing