MITM Attack Detection Method Based on ARP Cache Overtime
Hao Wu · Jisuanji gongcheng · 2008
Through studying the ARP-spoofing which is one of the most dangers in the Intranet, based on the ARP-cache-overtime mechanism, this paper proposes a method to detect Man-In-The-Middle(MITM) attack in the switch network, investigates ARP-cache-overtime mechanism based on Windows, presents a method to detect and calculates the overtime. Experimental results show that when host receives an ARP packet, the ARP cache item is updated. Before this item is overtime, the host can not send ARP request packet to the item. Therefore, in this period the host does not receive any ARP reply packet related to this item. If the ARP packet statistic is not agreed with the principle, ARP-spoofing happens.