Development of IDS for Detecting ARP Attack using DES Model

Address Resolution Protocol (ARP) is one of the important protocol in the TCP/IP suit. Address Resolution Protocol (ARP) resolves an IP address (32 bit Logical Address) to the physical address (48 bit MAC Address). Arp poisoning puts the attacker in position to intercept communications between the two computers. In ARP Spoofing, the attacker will gain all the data transferring on network. In the shared network the attacker will be able to reply to all the ARP requests which are transmitted in the network with its own MAC address and the attacker can maintain ARP table with actual addresses. Now each and every data from the host will be forwarded to the attacker. A two way communication will be maintained by the attacker by forwarding and replying to all data through itself between devices. In this paper, ARP poisoning and detection is shown. Attack is done by manipulating the IP address and MAC address. If there is any duplicate MAC address entry present in the ARP table a predefined script is launched with parameters as MAC address and IP address. And the duplicate IP address is removed from the table. In case of an attack it can also detect the real mapping of MAC to IP addresses. In ARP spoofing attacks, an attacker can pretend to be another host and gain access to sensitive information. The paper also focuses on designing a Discrete Event System (DES) based approach to detect ARP spoofed IP.