<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-arp-spoofing
description: >-
  Detect and mitigate ARP spoofing/poisoning attacks using arpwatch, Suricata rules, static ARP entries, and Dynamic ARP Inspection for LAN security.
domain: cybersecurity
subdomain: network-security
tags:
  - arp-spoofing
  - arp-poisoning
  - mitm
  - lan-security
  - arpwatch
  - dai
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557.002"]
  nist-csf: ["DE.CM-1", "PR.AC-5"]
  uuid: a4eb0f79-a7d0-4b10-92e4-3db84b203499
---

# Detecting ARP Spoofing

## Overview

ARP spoofing enables man-in-the-middle attacks on local networks by poisoning ARP caches
to redirect traffic through an attacker-controlled host. Detection combines passive monitoring
(arpwatch, Suricata), active validation (static ARP, DAI), and network design (segmentation,
802.1X). This is a critical LAN security control.

Mode: `[MODE: BLUE]` for detection; `[MODE: ARCHITECT]` for prevention design.

## Prerequisites

| Requirement | Details |
|---|---|
| arpwatch or arpalert for ARP change monitoring | Required |
| Suricata with ARP protocol support | Required |
| Managed switch with Dynamic ARP Inspection (DAI) capability | Required |
| DHCP snooping enabled (prerequisite for DAI) | Required |
| Network span/tap for passive monitoring | Required |

## Key Concepts

### ARP Spoofing Indicators

```
Detection Signals:
├── MAC address flapping (same IP, different MACs)
├── Gratuitous ARP storms (unsolicited ARP replies)
├── ARP replies without corresponding requests
├── Gateway MAC address change
├── Duplicate IP address detection
└── Unusually high ARP traffic volume
```

### Arpwatch Monitoring

```bash
# Install and start arpwatch
apt install arpwatch
arpwatch -i eth0 -f /var/lib/arpwatch/eth0.dat

# Monitor log for changes
tail -f /var/log/syslog | grep arpwatch

# Key events to alert on:
# "changed ethernet address" — MAC changed for known IP
# "flip flop" — MAC alternating between two values
# "new station" — previously unseen IP/MAC pair
```

### Suricata ARP Detection Rules

```yaml
# Detect ARP spoofing — gratuitous ARP flood
alert arp any any -> any any (msg:"ARP Spoofing - gratuitous ARP flood"; \
  arp.opcode:2; \
  threshold:type both, track by_src, count 20, seconds 10; \
  sid:5000001; rev:1;)

# Detect ARP reply without request (unsolicited)
alert arp any any -> any any (msg:"ARP Spoofing - unsolicited ARP reply"; \
  arp.opcode:2; \
  threshold:type both, track by_src, count 5, seconds 5; \
  sid:5000002; rev:1;)
```

### Wireshark ARP Filters

```
# Duplicate IP detection
arp.duplicate-address-detected

# Gratuitous ARP
arp.isgratuitous == 1

# ARP replies only
arp.opcode == 2

# ARP from specific MAC
eth.src == aa:bb:cc:dd:ee:ff and arp
```

### Prevention: Static ARP and DAI

```bash
# Static ARP entry for gateway (Linux)
arp -s 10.10.1.1 aa:bb:cc:dd:ee:ff

# Permanent static ARP (survives reboot)
echo "10.10.1.1 aa:bb:cc:dd:ee:ff" >> /etc/ethers
# Add to /etc/network/interfaces: post-up arp -f /etc/ethers

# Cisco switch — Dynamic ARP Inspection
# ip arp inspection vlan 10,20,30
# ip arp inspection validate src-mac dst-mac ip
```

## Workflow

### Step 1: Deploy Arpwatch

```bash
arpwatch -i eth0 -f /var/lib/arpwatch/eth0.dat
# Build baseline of IP-MAC bindings
```

### Step 2: Configure Alerts

```bash
# Syslog rule for ARP changes
# /etc/rsyslog.d/arpwatch.conf
:programname, isequal, "arpwatch" /var/log/arpwatch.log
```

### Step 3: Static ARP for Critical Assets

```bash
# Pin gateway and critical server MACs
arp -s 10.10.1.1 00:11:22:33:44:55   # Gateway
arp -s 10.10.1.10 00:11:22:33:44:66  # DNS server
arp -s 10.10.1.20 00:11:22:33:44:77  # Domain controller
```

### Step 4: Enable DAI on Switch

Configure DHCP snooping first, then enable DAI on access VLANs.

### Step 5: Verify

```bash
# Check current ARP table
arp -an | sort -t. -k4 -n

# Scan for duplicate MACs
arp-scan --localnet --interface=eth0 | sort -t$'\t' -k2 | uniq -D -f1
```

## Detection

```yaml
title: Arp Spoofing Detection
id: 895771e5-a72f-4602-8d04-4edaec5ad36d
status: experimental
description: Detects suspicious activity related to detecting arp spoofing techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1557.002
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Arp Spoofing Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557.002 |

## Verification

- [ ] Arpwatch running on all monitored segments
- [ ] Alerting configured for MAC address changes
- [ ] Static ARP entries for gateway and critical servers
- [ ] DAI enabled on access switch VLANs
- [ ] DHCP snooping enabled (prerequisite for DAI)
- [ ] ARP spoofing tested with controlled tool (verify detection)
- [ ] Incident response procedure for ARP spoofing alerts

## References

- MITRE ATT&CK T1557.002 — ARP Cache Poisoning
- CIS Controls v8 Control 13: Network Monitoring and Defense
- IEEE 802.1X for port-based access control
- [arpwatch documentation](https://linux.die.net/man/8/arpwatch)
