<![CDATA[ARP(Address Resolution Protocol) is a protocol to translate an IP address into MAC address. ARP is used when a host wants to communicate with another hosts whose MAC address is unknown, it broadcast an ARP request packet for the hardware address associated with the IP address of a destination. The host with corresponding protocol address sends a unicast reply to the sender. Protocol ARP is a stateless protocol which caused ARP protocol has a vulnerability. ARP vulnerability support a network attack called ARP Spoofing attack or ARP cache poisoned attack. ARP Spoofing attack perform cache poisoning by sending spoofed ARP packet. ARP spoofing is capable of executing the other attack such as DOS attack, Man in the middle attack, host impersonating, etc. This research was conducted to detect ARP Spoofing attack using based on ARP packet traffic. ARP packet traffic will be checked by detector host. Detector host checks the header of packet, amount of packet, MAC duplication and ARP request of ARP reply packet. The information of ARP spoofing packet will be written on log file. The classification rate was 89.64% and the average time to detect the attack is 0.4 second.]]>
Copyrights © 2019
