INTRO
ArpON is a network daemon based on the underlying ARP management
system offered by the kernel it runs on.
Basically, ArpON uses custom criteria/policies to make secure the ARP protocol,
and these criteria/policies are realized through the DARPI and SARPI protocols.
Finally, ArpON works in user space, making it portable on a large number of OSes.
FEATURES
ArpON OVERVIEW
Here is explained how ArpON works in details:
1) This is a normal connection between A and B:
2) This is a connection between A and B where a node (called C) is making a MITM attack:
- The ARP cache of the nodes A and B are poisoned by the node C;
- A communicates with B through C and viceversa, both ignoring what's happening behind the scenes.
3) This is a connection between A and B, where A runs ArpON to protect its ARP cache:
- The node A is no more poisoned by C, so it can send data directly with the node B;
- The node B is still poisoned, so it will send data to A passing through C;
- The node C forwards the traffic from B to A, so reading only one way of the communication.
4) This is a connection between A and B, both protected by ArpON:
- As you can see, A and B communicate safely, leaving the attacker out.
ARP cache poisoning has no more effect, and the connection is back again secure.
STATIC ARP INSPECTION
When SARPI starts, it saves statically all the ARP entries it finds
in the ARP cache in a static cache called SARPI Cache.
Note that you can also manage the ARP cache before starting SARPI,
through the "ARP CACHE MANAGER" feature of ArpON.
After the startup, ArpON operations are split in two parallel tasks:
- It automatically updates the ARP cache each time the timeout expires;
timeout is simply the expire time of each entry in the ARP cache,
defined according to the policy set in the running kernel.
Timeout is set by default to 10 minutes, but you can override this
value.
- It applies policies to the ARP cache, according to the following three
schemes:
1) For each received ARP reply, ArpON checks whether source addresses match an
entry in the SARPI cache. In such case, the static entry (previously saved
in the SARPI cache) will overwrite the new entry.
Here ArpON defends and blocks ARP Poisoning/Spoofing attacks
through the ARP replies.
2) For each received ARP request, ArpON checks wheter the source addresses
match an entry in the SARPI cache. In such case, the static entry
(previously saved in the SARPI cache) will overwrite the new entry.
Here, ArpON will defend and block ARP Poisoning/Spoofing attacks
through the ARP requests.
3) Every ARP request/reply whose source address doesn't match an entry in
the SARPI cache are just ignored.
Both these operations are a countermeasure against ARP Poisoning/Spoofing attacks,
as SARPI detects and blocks them.
SARPI doesn't affect the communication efficiency of the ARP protocol.
SARPI just manages a list with static entries, making it an optimal choice
in those networks without DHCP.
Finally, it's possible to use SARPI as a daemon, using the "TASK MODE" feature
of ArpON.
DYNAMIC ARP INSPECTION
DARPI startup phase consists in cleaning up the ARP cache, deleting all of its entries.
This is due because ARP cache may have poisoned entries from the beginning.
DARPI handles the so called DARPI cache, applying different policies to different kinds of packets:
- ARP request:
It traces ARP requests and follows these rules if traffic is:
1) Outbound:
Packets are generated by us. ArpON let them pass, adding an entry with
the target to the DARPI cache (see ARP reply - Inbound).
On this DARPI cache entry, DARPI sets timeout because if this entry doesn't
exist in network, DARPI must to delete it.
2) Inbound:
Packets come to us from the network. Kernel sends ARP reply to source address,
ArpON refuses the packet, deleting the entry of the source address from the
ARP cache, because such packet may be poisoned. Afterwards, ArpON will send an
ARP request to the source address, and it will be managed by ArpON through DARPI.
Here, ArpON will defend and block ARP Poisoning/Spoofing attacks
through the ARP requests.
- ARP reply:
It traces the ARP replies, and follows these rules if traffic is:
1) Outbound:
Packets are generated by us. ArpON just lets them pass.
2) Inbound:
Packets come to us from the network. ArpON checks whether the
source address matches an entry in the DARPI cache (see ARP request -
Outbound), it lets the packet flow, adding an entry in the ARP cache.
Otherwise, if the source address doesn't match any entry in the DARPI
cache, ArpON refuses the packet, deleting the entry from the ARP cache.
Here ArpON defends and blocks ARP Poisoning/Spoofing attacks
through the ARP replies.
Both types of packets are used to perform ARP Poisoning/Spoofing attacks, as
DARPI detects and blocks them.
DARPI doesn't affect the communication efficiency of the ARP protocol.
DARPI manages uniquely a list with dynamic entries. Therefore it's an optimal
solution in networks having DHCP.
Finally, it's possible to use DARPI as a network daemon, through the feature "TASK MODE" of ArpON.
