Chapter 1 Arp Attack Prevention Overview; Introduction To Arp Attacks - H3C LS-5100-16P-SI-OVS-H3 Configuration

H3C Low-End Ethernet Switches Configuration Examples
ARP Attack Prevention

Chapter 1 ARP Attack Prevention Overview

Recently, most campus networks suffer from ARP attacks possibly causing network
access problems. According to the characteristics of ARP attacks, H3C brings forth a
customized module for overall protection concept and provides two solutions as
follows:
1) ARP attack prevention solution in DHCP snooping mode
This solution applies to network scenarios where IP addresses are assigned
dynamically and DHCP snooping is enabled on the access switches. This solution,
after applied to the entire network, can effectively prevent common ARP attacks
including gateway spoofing, spoofing gateway, spoofing terminal user, ARP MITM, and
ARP flood attacks. You do not need to install extra software on the terminals, and thus
network configuration is simplified.
2) ARP attack prevention solution in authentication mode
This solution applies to network scenarios where static and dynamic IP address
allocation methods coexist and it can only prevent gateway spoofing attacks. In this
solution, you do not need to configure attack prevention on access switches. A client
only needs to pass the 802.1x authentication performed by an authentication server (a
CAMS server, for example). If the authentication is successful, the authentication
server provides the gateway's IP-to-MAC binding for the client to prevent gateway
spoofing attacks.

1.1 Introduction to ARP Attacks

According to the ARP design, after receiving an ARP response, a host adds the
IP-to-MAC mapping of the sender into its ARP mapping table even if the MAC address
is not requested by itself. This can reduce the ARP traffic in the network, but it also
makes ARP spoofing possible.
The following are some common ARP attacks on campus networks.
1) Gateway spoofing attack
In the following figure, an attacker sends an ARP packet with the gateway's IP address
and a fake MAC address to a client (Host A), which then updates the IP-to-MAC binding
of the gateway. After that, traffic from the client to the gateway is sent to the fake MAC
address, and the client is unable to access the external network.
Chapter 1 ARP Attack Prevention Overview
1-1