Detect and Prevent ARP Spoofing with Arpwatch and Dynamic ARP Inspection

Table of Contents

Problem Statement: Why Layer 2 Networks Fall for Spoofed Traffic

Traditional Layer 2 networks assume every host on the wire is honest. When a server needs to talk to an IP on the local subnet, it broadcasts an Address Resolution Protocol (ARP) query: Who has this IP? The owner answers with its Media Access Control (MAC) address, and both hosts update their local ARP caches.

Standard ARP includes zero authentication. Any rogue machine, compromised container, or rogue VM can fire off unsolicited gratuitous ARP replies. It can claim the IP of your default gateway, database node, or core DNS resolver. Target hosts blindly overwrite their cache tables. Traffic immediately routes through the attacker, enabling packet inspection, tampering, or silent blackholing.

This problem is not purely theoretical. Last year, our team spent three hours tracking down intermittent 502 errors and TLS handshake drops on a staging Kubernetes cluster. The culprit was a misconfigured test VM running an aggressive load-balancer script that continuously broadcast the default gateway IP (10.0.10.1) paired with its own MAC address. Over 40 worker nodes poisoned their caches within minutes.

Core Concepts: Passive Visibility vs. Active Switch Enforcement

Stopping ARP poisoning requires two complementary defense layers: host-level detection and switch-level hardware enforcement.

1. The Mechanics of ARP Cache Poisoning

Operating systems maintain an in-memory ARP table to avoid querying the broadcast domain for every packet. Suppose Host A (10.0.10.25) wants to reach Gateway 10.0.10.1. An attacker sends a forged packet claiming 10.0.10.1 is at aa:bb:cc:11:22:33. Host A accepts the frame and updates its ARP table without validation. From that point on, Host A directs all egress traffic directly to the attacker.

2. Passive Detection with Arpwatch

Arpwatch is a lightweight Linux daemon that monitors Layer 2 broadcast activity. It maps IP-to-MAC pairings over time and logs anomalies to syslog or email alerts whenever an IP adopts a new MAC address, flips between interfaces, or introduces an unregistered vendor OUI.

3. Active Prevention with Dynamic ARP Inspection (DAI)

Arpwatch alerts you after an incident begins, but it cannot drop malicious frames. That is where Dynamic ARP Inspection (DAI) comes in. DAI is a hardware feature on managed switches. It intercepts ARP requests and responses on untrusted access ports, checking each frame against the switch DHCP Snooping binding database. If the IP-to-MAC pairing does not match a valid lease, the switch ASIC drops the frame immediately.

Hands-on Practice: Deploying Arpwatch and Switch-Level DAI

Here is a step-by-step implementation. We will configure passive alerting on an Ubuntu monitor node first, then lock down switch access ports.

Step 1: Install and Configure Arpwatch on Linux

Install the package on your management host or dedicated network probe:

sudo apt update
sudo apt install -y arpwatch

Identify your monitoring interface with ip link show, then edit the service defaults:

sudo nano /etc/default/arpwatch

Specify the listening interface and notification recipient:

# /etc/default/arpwatch
INTERFACES="eth0"
ARGS="-N -m [email protected] -R 6"

Initialize the state file and start the daemon:

# Initialize tracking database
sudo touch /var/lib/arpwatch/arp.dat
sudo chown -R arpwatch:arpwatch /var/lib/arpwatch

# Start service
sudo systemctl enable --now arpwatch
sudo systemctl status arpwatch

Follow live detections in your system journal:

sudo journalctl -u arpwatch -f

When an address conflict occurs, Arpwatch logs a structured alert:

arpwatch: changed ethernet address: 10.0.10.1 00:50:56:a1:2b:3c (old 00:0c:29:4f:8e:12)

Step 2: Enable DHCP Snooping on the Access Switch

DAI relies on the DHCP Snooping database to verify dynamic IP assignments. On your switch (Cisco IOS syntax shown), enable snooping globally and bind it to your user/server VLAN (e.g., VLAN 10):

Switch# configure terminal
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)# no ip dhcp snooping information option

Set your uplink port to trusted mode so genuine DHCP server offers are permitted:

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# description Core-Router-Uplink
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)# exit

Step 3: Enable Dynamic ARP Inspection (DAI)

With snooping active, turn on DAI for VLAN 10 and enable strict payload validation:

Switch(config)# ip arp inspection vlan 10
Switch(config)# ip arp inspection validate src-mac dst-mac ip

Trust the uplink interface to allow valid router ARP replies across the trunk:

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# ip arp inspection trust
Switch(config-if)# exit

Apply rate limiting on untrusted access ports. This prevents attackers from exhausting switch CPU resources with ARP floods:

Switch(config)# interface range GigabitEthernet0/2 - 24
Switch(config-if-range)# ip arp inspection limit rate 15
Switch(config-if-range)# exit

Step 4: Permit Static IP Hosts Using ARP Access Lists

Statically addressed servers do not generate DHCP requests, so they will lack DHCP Snooping entries. Without an override, DAI will drop their legitimate traffic. Define an ARP Access List for these endpoints:

Switch(config)# arp access-list STATIC-SERVERS
Switch(config-arp-nacl)# permit ip host 10.0.10.10 mac host 0050.56a1.2b3c
Switch(config-arp-nacl)# permit ip host 10.0.10.11 mac host 0050.56a1.4d5e
Switch(config-arp-nacl)# exit

Switch(config)# ip arp inspection filter STATIC-SERVERS vlan 10 static

Step 5: Verify Bindings and Inspect Drop Counters

Confirm that the switch has populated its lease table:

Switch# show ip dhcp snooping binding

Check the DAI drop statistics to verify protection:

Switch# show ip arp inspection vlan 10

Source Mac Validation      : Enabled
Destination Mac Validation : Enabled
IP Transition Validation   : Enabled

Vlan 10 Configuration
---------------------
Verify Source MAC          : Enabled
Verify Destination MAC     : Enabled
Verify IP                  : Enabled

Vlan 10 Statistics
------------------
Forwarded                  : 128450
Dropped                    : 23
DHCP Drops                 : 23
ACL Drops                  : 0

Conclusion

Arpwatch gives you quick, host-level visibility across Linux subnets. However, real Layer 2 defense requires hardware enforcement. Combining DHCP Snooping and Dynamic ARP Inspection on your switches stops poisoning attempts at the physical port, protecting your gateway and servers from Man-in-the-Middle attacks.