Dynamic ARP detection to prevent man-in-the-middle attacks

ARP is a double-edged sword for the network. On the one hand, ARP is an indispensable protocol in network communication. It is like a programmer, which determines the data transmission path to a certain extent. On the other hand, it is easy to be used by attackers and plays an inappropriate role. Currently, ARP attacks are not at a low level. Although there are also a lot of related measures, it is difficult to prevent them. To solve this problem, Cisco has designed dynamic ARP detection technology in its network products. Although this technology cannot fundamentally solve the security risks caused by ARP, it is still unique in curbing its dangers, especially man-in-the-middle attacks.

I. mitm attack case Simulation

　　

For example, it is a simple network architecture diagram. Three terminals are connected to the same workgroup switch at the same time. (There may be more terminals in the actual situation. For the sake of simplicity, I will take three terminals as an example ). In this case, if host A needs to access host B (only the IP address of the other party is known but not the MAC address is known during the first access), it needs to send an ARP request first. Ask each host about the MAC address of host. This ARP request will be transmitted in the network in the form of broadcast, that is, each client in the network will receive this information. Normally, unrelated hosts except B will discard this packet. However, only host B receives this request will respond. Host B will first create A record of host A's IP address and MAC address in its ARP cache (if this IP address already exists, it will be updated ), and sends an ARP response to host. In this case, the ARP response is A unicast packet that is directly sent to host A instead of broadcast.

The above is a normal ARP process. However, in this process, if appropriate security measures are not taken, it is likely to cause man-in-the-middle attacks. As shown in, if Terminal Device C does not discard this packet after receiving the ARP request sent by host, instead, the attacker can initiate man-in-the-middle attacks by sending a forged ARP response (replacing the MAC address of host B with the MAC address of host B. After receiving the ARP response from host C, host A cannot have the correct MAC address and IP address of host B. For host A, it will mistakenly think that host C is the object of data to be sent. In this way, data is directly sent to host C. In this case, any communication between host A and host B will be sent to host C. Then host C may redirect traffic after obtaining the relevant content. In this process, host C is called a man-in-the-middle. This process is called Man-in-the-middle attack.
2. Preventing man-in-the-middle attacks through dynamic ARP Detection

To effectively prevent man-in-the-middle attacks, dynamic ARP detection is designed in Cisco's network products. The principle is relatively simple, that is, the related ports of the switch will automatically detect that the ARP packet comes from the correct port and is not changed or spoofed by attackers. This principle is simple, but it requires a lot of technical processing to be implemented. Usually, the correct port can be determined by the vswitch through DHCP listening and binding table. If the data of a vswitch comes from an incorrect port, the packet is automatically discarded and related information is recorded. In addition, the illegal port is set to the err-disable state, and attackers cannot further damage the network.

As shown in, to enable dynamic ARP detection in this environment, you need to perform the following steps.

The first step is to enable DHCP listening on each switch port. As shown above, dynamic ARP detection needs to determine whether the data port comes from a valid port. To detect this content, you must have a DHCP listener binding table. This table is created by a DHCP listener. You need to enable this listening service on all interfaces of the vswitch. Otherwise, problems may occur.

The second step is more important. It is necessary to configure the connection between switches as the DAI (Dynamic ARP detection) Trust port. In the above example, I drew only one working group switch for the sake of simplicity. In practice, enterprises often have multiple switches to form a network. What if dynamic ARP Detection is Enabled between multiple switches? The configuration that needs to be done is to configure the link between switches as the DAI trusted port. You can use the ip arp inspection trust command.

When the dynamic ARP detection function is enabled, how can the switch cope with man-in-the-middle attacks? As shown in, when attacker C connects to a working group switch and tries to send a false ARP response, the switch detects this attack based on the DHCP listener binding table and discards this ARP packet. Then, the switch sets the port connecting the attacker C to err-disable and sends an alarm to the Administrator.

When dynamic ARP Detection is enabled, pay attention to the false diagnosis. As shown in, if mitm C is not directly connected to a workgroup switch. It is connected to a hub. Then connect to the vswitch through this hub. In this case, when an intermediary attack is triggered, the switch will disable this interface. In this case, all hosts connected to this interface cannot communicate with the network. This "one person is guilty and the whole family is punished" approach often involves innocent. When enabling this function, the network administrator must consider this negative effect. It will also be of reference value when troubleshooting in the future.

Iii. Functions of dynamic ARP detection in other aspects

ARP dynamic detection has a special performance in preventing man-in-the-middle attacks. However, its functions are far more than this. For example, ARP dynamic detection can also implement ARP suppression. This limits the inbound ARP packet rate. If the ARP packet rate reaches a specified value, there may be ARP attacks on the network. In this case, the switch automatically sets this interface to disable. To enable the ARP Suppression Function, You need to configure it in the vswitch. For example, you can run the following command: ip arp inspection limit rate (ARP packet rate ). It is not difficult to execute this configuration. The difficulty lies in how to determine the speed. If the speed setting is relatively high, the ARP Suppression Function will not be available. On the contrary, if the setting is relatively low, it may affect the normal use of the network.

4. technologies required for dynamic ARP Detection

From the above analysis, we can see that dynamic ARP detection is not an independent technology, and it must be assisted by other technologies. Therefore, I prefer to call it a combination of technologies. To enable the DHCP listener, The vswitch can determine the validity of the data source interface. When ARP Detection is enabled, the switch automatically determines whether necessary auxiliary technologies are enabled. If it is not enabled, the switch reports an error and terminates the user's request. Therefore, when configuring this function, the network administrator also needs to understand other associated technologies. In particular, you need to understand the prerequisites for its implementation, that is, the technologies that need to be enabled first.

In practical work, for example, during user introduction or training, the author regards dynamic ARP detection technology as a security solution (a combination of several technologies), rather than a separate technology. This requires attention in both learning and configuration. I once again stressed that dynamic ARP detection is a security solution combined with DHCP listening technology, IPSG technology, and so on. It is mainly used to solve the security problems related to ARP attacks. It effectively protects access layer ARP attacks in multi-layer switching networks, such as ARP man-in-the-middle attacks, ARP spoofing, ARP diffusion attacks, and ARP suppression. Of course, there will be some negative effects in the implementation process. The biggest negative impact is the loss of other innocent users connected to the same interface. This problem must be taken into account when designing and deploying the dynamic ARP detection function. For example, if a network fault occurs on the terminal connected to an interface and other interfaces operate normally, you need to consider whether the problem is caused by this cause.