Abstract: Via address resolution protocol in data link layer, hackers can launch various attacks, such as IP conflict attack, ARP deceive attack and ARP overflow attack. Because ARP implements the mapping between IP and MAC, malicious attacks based on ARP are difficult to detect. The defense system can effectively detect ARP attacks using tracing network ARP buffers, counting ARP packets and actively examining ARP packets.

摘要： 利用数据链路层地址解析协议(ARP)可以进行IP冲突、ARP欺骗、ARP溢出等方式的网络攻击。因为ARP具有实现IP地址到网络接口硬件地址(MAC)的映射功能,所以利用此特性在数据链路层发动的攻击具有很强的隐蔽性。针对ARP攻击的网络防御模式通过跟踪网络主机ARP缓存的变化、统计ARP数据包、主动验证ARP数据包3种方法,可以有效地侦测ARP攻击,并提供了网络防御的方法。

关键词: ARP协议, 网络攻击, 侦测与防御

CLC Number: 

• TP393.02