Implementing Cisco Networking Solutions

ARP spoofing

An attacker can send a gratuitous ARP packet (an ARP reply sent without first receiving an ARP request) with a spoofed source address, causing the default gateway or another host to learn about it and store it in its ARP table. The ARP protocol (RFC 826) will create an entry for any such malicious host without performing any type of authentication or filtering. This behavior results in vulnerability to spoofing attacks and that lets the attacker receive frames intended for another user. This can be prevented by blocking all user-to-user communication by using the Switchport protected command. This allows only the users to talk to the gateway and not talk to each other on the network. We will discuss this in more detail in the ...