
Abnormal ARP Traffic Detection and Prevention ◾ 65
The XArp 2 CorruptFilter alert message indicates that the
ARP packet includes incorrect values. That is, the Ethernet
source MAC address does not match the ARP source MAC
address. XArp 2 checks these values for correctness.
◾ Packet #3: Host A sends an abnormal Unicast ARP request
packet to Host B. An ARP request packet needs to be sent
to the broadcast MAC address. However, in this experiment,
the generated ARP request packet has been sent to a Unicast
MAC address (MAC address of Host B), as shown here:
ARP Header
Operation code 1 (for ARP request)
Source IP address IP address of Host A
Source ...