
Abnormal ARP Traffic Detection and Prevention ◾ 55
3.3.1 Cross-Layers ARP Inspection
To detect the abnormal ARP packets P#2, P#6, and P#8
described in Tables3.1 and 3.2, the ARP inspection mecha-
nism should be able to perform cross-layers ARP inspection
between the Ethernet and ARP headers. In ARP request and
reply packets, the Ethernet source MAC address must match
the ARP source MAC address. However, in an ARP reply
packet, the Ethernet destination MAC address must match the
ARP destination MAC address. Table3.5 lists security solutions
that include cross-layers ARP inspection mechanisms.
3.3.2 ARP Stateful Inspection
ARP replies shoul ...