
45
Chapter 3
Abnormal ARP
Traffic Detection
and Prevention
3.1 Introduction
Abnormal ARP (Address Resolution Protocol) packets are
usually injected into a network to corrupt the ARP caches of
target hosts. An ARP poisoning attack, described in Chapter2,
is an example of attacks that use abnormal ARP packets to
eavesdrop and manipulate data flowing through a LAN (Local
Area Network). Abnormal ARP packet based attacks are of
special interest because they are highly intentional and are
usually initiated, maintained, and controlled by humans. These
attacks can be performed by novices, using widely available
and easy-to-use tools specially designed ...