Defense against ARP spoofing/poisoning
Posted by hackthisway on October 25, 2009
ONLY local attackers can carry on ARP attacks.
There is no specific and fullproof way to patch or getrid of these attacks but administrators can atleast prevent it, there are tools available to monitor for ARP poisoning, e.g. ARPwatch , Get it from http://www.icewalkers.com/Linux/Software/528110/arpwatch-NG.html
For Windows , there is a tool called WinARPwatch , get it from http://www.hacker-soft.net/down.php?id=9980&url=1
Read me file of WinARPwatch
So this program watches the cache and stores every new IP/MAC combination to it’s own lists. If a combination is already known, the program compares it with the cache to see if has changed.If it has changed an icon will start to blink in the sys-tray. Clicking that icon to bring up the program to see what has happened.This program isn’t useful/working for dial-up linkssince PPP doesn’t use ARP, thus isn’t wulnerable to ARP Poisoning.
