Overview of ARP Security
Definition
Address Resolution Protocol (ARP) security prevents ARP attacks and ARP-based network scanning attacks using a series of methods such as strict ARP learning, dynamic ARP inspection (DAI), ARP anti-spoofing, and rate limit on ARP packets.
Purpose
ARP is easy to use but lacks security protection mechanisms. Attackers may use ARP to attack network devices. The following ARP attacks exist on networks:
ARP flood attack: ARP flood attacks, also called denial of service (DoS) attacks, occur in the following scenarios:
Processing ARP packets and maintaining ARP entries consume system resources. Network devices limit the number of stored ARP entries to improve ARP entry query efficiency. Attackers send a large number of bogus ARP packets with variable source IP addresses to consume ARP entries on a target device. Therefore, the target device cannot generate ARP entries when receiving ARP packets from authorized users. Consequently, communication is interrupted.
Attackers send a large number of IP packets with unresolvable destination IP addresses to scan the hosts on the local or remote network segments. The target devices generate many ARP Miss messages and deliver many temporary ARP entries. In addition, the target devices broadcast a large number of ARP Request packets to resolve the destination IP addresses of the IP packets received from attackers. These operations cause CPU overloading.
ARP spoofing attack: Attackers send bogus ARP packets to target devices, causing these devices to modify the ARP entries of other network devices or user hosts. As a result, these network devices or user hosts cannot communicate with one another other.
- Network connections are unstable and communication is interrupted.
- Attackers initiate ARP spoofing attacks to obtain user packets and thus obtain the accounts and passwords of the users, for example, game, online banking, and file server accounts and passwords, leading to losses for customers.
Table 10-1 and Table 10-2 describes various ARP security techniques for defending against different ARP attacks.
Measure |
Description |
Deployment |
|---|---|---|
Rate limiting on ARP packets |
Limits the rate of ARP packets to ensure that a device has sufficient CPU resources to process other services. |
You are advised to enable this function on the gateway. |
Rate limiting on ARP Miss messages |
Limits the rate of ARP Miss messages to prevent attacks from a large number of IP packets with unresolvable destination IP addresses. |
You are advised to enable this function on the gateway. |
Gratuitous ARP packet discarding |
Allows a device to discard gratuitous ARP packets to ensure that the device has sufficient CPU resources to process other services. |
You are advised to enable this function on the gateway. |
Strict ARP learning |
Allows a device to learn only ARP entries for ARP Reply packets in response to ARP Request packets that it has sent, but does not allow the device to learn the ARP entries for the ARP packets received from other devices. This prevents ARP entries from being exhausted by invalid ARP packets. |
You are advised to enable this function on the gateway. |
ARP entry limiting |
Limits the total number of ARP entries that can be dynamically learned by a device's interface to prevent ARP entries from being exhausted when a user host connected to the interface attacks the device. |
You are advised to enable this function on the gateway. |
Disabling ARP learning on interfaces |
When a user host connected to an interface on a target device initiates an ARP attack, ARP resources of the target device will be exhausted. This function prevents such ARP attacks. |
You are advised to enable this function on the gateway. |
Measure |
Description |
Deployment |
|---|---|---|
ARP entry fixing |
After a device with this function enabled learns an ARP entry for the first time, it does not modify the ARP entry, but only updates part of the entry, or sends an ARP Request packet to check the validity of the ARP packet for updating the entry. This function prevents attackers from modifying the ARP entries of authorized users by using forged ARP packets. The device supports three ARP entry fixing modes: fixed-all, fixed-mac, and send-ack. |
You are advised to enable this function on the gateway. |
Dynamic ARP inspection (DAI) |
Allows a device to compare the source IP address, source Media Access Control (MAC) address, interface number, and Virtual Local Area Network (VLAN) ID of an ARP packet with binding entries. If an entry is matched, the device considers the ARP packet valid and allows the packet to pass through. If no entry is matched, the device considers the ARP packet invalid and discards the packet. This function is available only for Dynamic Host Configuration Protocol Snooping (DHCP snooping) scenarios. |
You are advised to enable this function on an access device. |
Gratuitous ARP packet discarding |
Allows a device to discard gratuitous ARP packets so that the device can prevent attacks from a large number of bogus gratuitous ARP packets, preventing communication interruptions. |
You are advised to enable this function on the gateway. |
MAC address consistency check in an ARP packet |
Prevents attacks from bogus ARP packets in which the source and destination MAC addresses are different from those in the Ethernet frame header. |
You are advised to enable this function on the gateway. |
Strict ARP learning |
Allows a device to learn only ARP entries for ARP Reply packets in response to ARP Request packets that it has sent, but does not allow the device to learn the ARP entries for the ARP packets received from other devices. This prevents the device from incorrectly updating ARP entries for the received bogus ARP packets. |
You are advised to enable this function on the gateway. |
Benefits
- Reduces maintenance costs for network operating and security.
- Provides users with stable services on a secure network.