Address Resolution Protocol (ARP) security protects network devices against ARP attacks by learning ARP entries, rate-limiting ARP packets, and checking ARP packets. In addition to preventing ARP protocol attacks, ARP security also fends off ARP-based network scanning attacks.
ARP is easy to use but lacks security protection mechanisms. Attackers may use ARP to attack network devices. The following ARP attacks exist on networks:
ARP flood attack: ARP flood attacks, also called denial of service (DoS) attacks, occur in the following scenarios:
Processing ARP packets and maintaining ARP entries consume system resources. Network devices limit the number of stored ARP entries to improve ARP entry query efficiency. Attackers send a large number of bogus ARP packets with variable source IP addresses to consume ARP entries on a target device. Therefore, the target device cannot generate ARP entries when receiving ARP packets from authorized users. Consequently, communication is interrupted.
Attackers send a large number of IP packets with unresolvable destination IP addresses to scan the hosts on the local or remote network segments. The target devices generate many ARP Miss messages and deliver many temporary ARP entries. In addition, the target devices broadcast a large number of ARP Request packets to resolve the destination IP addresses of the IP packets received from attackers. These operations cause CPU overloading.
ARP spoofing attack: Attackers send bogus ARP packets to target devices, causing these devices to modify the ARP entries of other network devices or user hosts. As a result, these network devices or user hosts cannot communicate with one another.
To address the preceding problems, ARP security can be deployed.