Editing ARP spoofing (section)

==Defenses==

===Static ARP entries===
The simplest form of certification is the use of static, read-only entries for critical services in the [[ARP cache]] of a host. IP address-to-MAC address mappings in the local ARP cache may be statically entered. Hosts don't need to transmit ARP requests where such entries exist.<ref name="Lockhart-2007-p186">{{cite book|author=Lockhart, Andrew|title=Network security hacks|publisher=O'Reilly|year=2007|isbn=978-0-596-52763-1|page=[https://archive.org/details/networksecurityh02edunse/page/186 186]|url=https://archive.org/details/networksecurityh02edunse|url-access=registration}}</ref> While static entries provide some security against spoofing, they result in maintenance efforts as address mappings for all systems in the network must be generated and distributed. This does not scale on a large network since the mapping has to be set for each pair of machines resulting in ''n''<sup>2</sup>-''n'' ARP entries that have to be configured when ''n'' machines are present; On each machine there must be an ARP entry for every other machine on the network; ''n-1'' ARP entries on each of the ''n'' machines.

===Detection and prevention software===
Software that detects ARP spoofing generally relies on some form of certification or cross-checking of ARP responses. Uncertified ARP responses are then blocked. These techniques may be integrated with the [[DHCP server]] so that both [[Dynamic IP|dynamic]] and [[static IP]] addresses are certified. This capability may be implemented in individual hosts or may be integrated into [[Ethernet switch]]es or other network equipment. The existence of multiple IP addresses associated with a single MAC address may indicate an ARP spoof attack, although there are legitimate uses of such a configuration. In a more passive approach, a device listens for ARP replies on a network, and sends a notification via [[email]] when an ARP entry changes.<ref>{{cite web |url=https://www.researchgate.net/publication/282568321 |title=A Security Approach to Prevent ARP Poisoning and Defensive tools |website=ResearchGate|language=en|access-date=2019-03-22 |archive-date=2019-05-03|archive-url=https://web.archive.org/web/20190503221834/https://www.researchgate.net/publication/282568321_A_Security_Approach_to_Prevent_ARP_Poisoning_and_Defensive_tools|url-status=live}}</ref>

AntiARP<ref>[http://www.antiarp.com/english.html AntiARP] {{webarchive |url=https://web.archive.org/web/20110606051646/http://www.antiarp.com/english.html |date=June 6, 2011 }}</ref> also provides Windows-based spoofing prevention at the kernel level. ArpStar is a Linux module for kernel 2.6 and Linksys routers that drops invalid packets that violate mapping, and contains an option to repoison or heal.

Some virtualized environments such as [[Kernel-based Virtual Machine|KVM]] also provide security mechanisms to prevent MAC spoofing between guests running on the same host.<ref>{{cite web |url=https://www.berrange.com/posts/2011/10/03/guest-mac-spoofing-denial-of-service-and-preventing-it-with-libvirt-and-kvm/ |title=Daniel P. Berrangé » Blog Archive » Guest MAC spoofing denial of service and preventing it with libvirt and KVM |access-date=2019-08-09 |archive-date=2019-08-09 |archive-url=https://web.archive.org/web/20190809113318/https://www.berrange.com/posts/2011/10/03/guest-mac-spoofing-denial-of-service-and-preventing-it-with-libvirt-and-kvm/ |url-status=live }}</ref>

Additionally some Ethernet adapters provide MAC and VLAN anti-spoofing features.<ref>{{cite web |url=https://downloadmirror.intel.com/26556/eng/README.txt |title=Archived copy |access-date=2019-08-09 |archive-date=2019-09-03 |archive-url=https://web.archive.org/web/20190903084638/https://downloadmirror.intel.com/26556/eng/README.txt |url-status=live }}</ref>

[[OpenBSD]] watches passively for hosts impersonating the local host and notifies in case of any attempt to overwrite a permanent entry.<ref>{{cite web |url=https://man.openbsd.org/arp.4 |title=Arp(4) - OpenBSD manual pages |access-date=2019-08-09 |archive-date=2019-08-09 |archive-url=https://web.archive.org/web/20190809120053/https://man.openbsd.org/arp.4 |url-status=live }}</ref>

===OS security===
Operating systems react differently. Linux ignores unsolicited replies, but, on the other hand, uses responses to requests from other machines to update its cache. Solaris accepts updates on entries only after a timeout. In Microsoft Windows, the behavior of the ARP cache can be configured through several registry entries under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, ArpCacheLife, ArpCacheMinReferenceLife, ArpUseEtherSNAP, ArpTRSingleRoute, ArpAlwaysSourceRoute, ArpRetryCount.<ref>{{cite web |url=https://technet.microsoft.com/en-us/library/cc940021.aspx |title=Address Resolution Protocol<!-- Bot generated title --> |date=18 July 2012 |access-date=2017-08-26 |archive-date=2021-01-23 |archive-url=https://web.archive.org/web/20210123000849/https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc940021(v=technet.10)?redirectedfrom=MSDN |url-status=live }}</ref>