[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE937JN2Y9F54AR49AF329":3,"skill-same:01M6AE937JN2Y9F54AR49AF329":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6AE937JN2Y9F54AR49AF329","detecting-arp-poisoning-in-network-traffic",null,"Detect Layer 2 ARP poisoning\u002Fspoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scripts that flag gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses. Use when investigating suspected man-in-the-middle interception or session hijacking on a local network segment, or when building layer-2 anomaly detection for a SOC.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-arp-poisoning-in-network-traffic\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"detecting arp poisoning in network traffic","network","mitm","layer-2-security","man-in-the-middle","arpwatch","dynamic-arp-inspection","arp-spoofing","arp-poisoning","detection","python","network-security","Wireshark","soc","monitoring","pr","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: detecting-arp-poisoning-in-network-traffic\ndescription: Detect Layer 2 ARP poisoning\u002Fspoofing by deploying ARPWatch, Dynamic ARP\n  Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scripts\n  that flag gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses.\n  Use when investigating suspected man-in-the-middle interception or session hijacking\n  on a local network segment, or when building layer-2 anomaly detection for a SOC.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- arp-poisoning\n- arp-spoofing\n- mitm\n- dynamic-arp-inspection\n- arpwatch\n- network-security\n- man-in-the-middle\n- layer-2-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1557.002\n- T1557\n- T1040\n- T1200\n---\n\n# Detecting ARP Poisoning in Network Traffic\n\n## Overview\n\nARP poisoning (ARP spoofing) is a Layer 2 attack where an adversary sends falsified ARP messages to associate their MAC address with the IP address of a legitimate host, enabling man-in-the-middle (MitM) interception, session hijacking, or denial of service. Since ARP has no built-in authentication mechanism, any device on a broadcast domain can forge ARP replies. Detection requires monitoring ARP traffic for anomalies such as gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses. This skill covers deploying multiple detection layers including ARPWatch, Dynamic ARP Inspection (DAI), Wireshark-based analysis, and custom Python monitoring tools.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting arp poisoning in network traffic\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Access to the target network segment (broadcast domain)\n- Linux host for ARPWatch and custom monitoring tools\n- Managed switches supporting Dynamic ARP Inspection (Cisco Catalyst, Aruba, Juniper EX)\n- Wireshark or tcpdump for packet capture\n- DHCP snooping configured (prerequisite for DAI)\n- Network monitoring infrastructure (SIEM, syslog server)\n\n## Core Concepts\n\n### ARP Protocol Fundamentals\n\nARP maps IP addresses to MAC addresses on a local network segment. The protocol operates statelessly with no authentication:\n\n```\nNormal ARP Process:\n1. Host A broadcasts: \"Who has 10.0.1.1? Tell 10.0.1.100\"\n2. Router replies: \"10.0.1.1 is at AA:BB:CC:DD:EE:01\"\n3. Host A caches the mapping\n\nARP Poisoning Attack:\n1. Attacker sends unsolicited ARP reply to Host A:\n   \"10.0.1.1 is at EV:IL:MA:CA:DD:RR\" (attacker's MAC)\n2. Host A updates cache, sends traffic to attacker\n3. Attacker forwards to real gateway (MitM position)\n```\n\n### Attack Indicators\n\n| Indicator | Description | Severity |\n|-----------|-------------|----------|\n| MAC flip-flopping | Same IP mapped to different MACs rapidly | High |\n| Gratuitous ARP flood | Unsolicited ARP replies targeting multiple hosts | High |\n| Duplicate IP address | Two different MACs claiming same IP | Critical |\n| Unusual ARP volume | Spike in ARP packets per second | Medium |\n| ARP from non-DHCP source | Static IP claims from unknown devices | Medium |\n| Gateway MAC change | Default gateway MAC address changed | Critical |\n\n## Workflow\n\n### Step 1: Deploy ARPWatch for Continuous Monitoring\n\n```bash\n# Install ARPWatch\nsudo apt-get install -y arpwatch\n\n# Configure ARPWatch\nsudo vi \u002Fetc\u002Fdefault\u002Farpwatch\n# INTERFACES=\"eth0\"\n# ARGS=\"-N -p -i eth0 -f \u002Fvar\u002Flib\u002Farpwatch\u002Farp.dat\"\n\n# Start monitoring\nsudo systemctl enable arpwatch\nsudo systemctl start arpwatch\n\n# View current ARP database\ncat \u002Fvar\u002Flib\u002Farpwatch\u002Farp.dat\n\n# Monitor logs for changes\ntail -f \u002Fvar\u002Flog\u002Fsyslog | grep arpwatch\n```\n\nARPWatch alert types:\n- **new station** - Previously unseen MAC address\n- **changed ethernet address** - IP mapped to different MAC (potential poisoning)\n- **flip flop** - MAC alternating between two addresses (active attack)\n- **reused old ethernet address** - Previously seen mapping returned\n\n### Step 2: Configure Dynamic ARP Inspection (DAI) on Switches\n\n**Cisco Catalyst configuration:**\n\n```\n! Enable DHCP snooping (prerequisite for DAI)\nip dhcp snooping\nip dhcp snooping vlan 10,20,30\n\n! Configure trusted ports (uplinks, DHCP servers)\ninterface GigabitEthernet1\u002F0\u002F1\n description Uplink to Distribution\n ip dhcp snooping trust\n\ninterface GigabitEthernet1\u002F0\u002F48\n description DHCP Server\n ip dhcp snooping trust\n\n! Enable Dynamic ARP Inspection\nip arp inspection vlan 10,20,30\n\n! Configure trusted ports for DAI\ninterface GigabitEthernet1\u002F0\u002F1\n ip arp inspection trust\n\n! Set rate limits to prevent ARP flood DoS\ninterface range GigabitEthernet1\u002F0\u002F2-47\n ip arp inspection limit rate 15\n\n! Enable additional validation checks\nip arp inspection validate src-mac dst-mac ip\n\n! Configure ARP ACL for static IP devices (servers, printers)\narp access-list STATIC-ARP-ENTRIES\n permit ip host 10.0.10.100 mac host 0011.2233.4455\n permit ip host 10.0.10.101 mac host 0011.2233.4456\n\nip arp inspection filter STATIC-ARP-ENTRIES vlan 10\n\n! Verify DAI status\nshow ip arp inspection vlan 10\nshow ip arp inspection statistics\nshow ip dhcp snooping binding\n```\n\n### Step 3: Wireshark Detection Filters\n\n```\n# Detect gratuitous ARP (sender and target IP are the same)\narp.src.proto_ipv4 == arp.dst.proto_ipv4\n\n# Detect ARP replies (focus on unsolicited)\narp.opcode == 2\n\n# Detect duplicate IP address claims\narp.duplicate-address-detected\n\n# Detect ARP packets from specific attacker MAC\neth.src == ev:il:ma:ca:dd:rr\n\n# Detect ARP storms (high volume)\n# Use Statistics > I\u002FO Graphs > Display filter: arp\n\n# Detect gateway impersonation\narp.src.proto_ipv4 == 10.0.1.1 && arp.src.hw_mac != aa:bb:cc:dd:ee:01\n```\n\n### Step 4: Custom Python ARP Monitor\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"\nReal-time ARP poisoning detection using packet capture.\nMonitors ARP traffic for spoofing indicators and alerts on anomalies.\n\"\"\"\n\nimport subprocess\nimport sys\nimport json\nimport time\nfrom collections import defaultdict\nfrom datetime import datetime\n\ntry:\n    from scapy.all import sniff, ARP, Ether, get_if_hwaddr, conf\n    SCAPY_AVAILABLE = True\nexcept ImportError:\n    SCAPY_AVAILABLE = False\n\n\nclass ARPPoisonDetector:\n    def __init__(self, interface: str, gateway_ip: str, gateway_mac: str):\n        self.interface = interface\n        self.gateway_ip = gateway_ip\n        self.gateway_mac = gateway_mac.lower()\n        self.arp_table = {}  # IP -> MAC mapping\n        self.arp_history = defaultdict(list)  # IP -> list of (MAC, timestamp)\n        self.alerts = []\n        self.arp_count = defaultdict(int)  # Source MAC -> count per interval\n        self.last_reset = time.time()\n        self.arp_rate_threshold = 50  # ARP packets per 10 seconds\n\n    def alert(self, severity: str, message: str, details: dict):\n        \"\"\"Generate alert for detected anomaly.\"\"\"\n        alert_data = {\n            'timestamp': datetime.now().isoformat(),\n            'severity': severity,\n            'message': message,\n            'details': details,\n        }\n        self.alerts.append(alert_data)\n        print(f\"\\n[{severity}] {datetime.now().strftime('%H:%M:%S')} - {message}\")\n        for key, value in details.items():\n            print(f\"  {key}: {value}\")\n\n    def check_gateway_spoofing(self, src_ip: str, src_mac: str):\n        \"\"\"Check if someone is spoofing the gateway.\"\"\"\n        if src_ip == self.gateway_ip and src_mac != self.gateway_mac:\n            self.alert('CRITICAL', 'Gateway ARP Spoofing Detected', {\n                'gateway_ip': self.gateway_ip,\n                'expected_mac': self.gateway_mac,\n                'spoofed_mac': src_mac,\n                'action': 'Potential MitM attack on default gateway',\n            })\n            return True\n        return False\n\n    def check_mac_change(self, src_ip: str, src_mac: str):\n        \"\"\"Check if IP-to-MAC mapping has changed.\"\"\"\n        if src_ip in self.arp_table:\n            known_mac = self.arp_table[src_ip]\n            if known_mac != src_mac:\n                self.alert('HIGH', 'ARP Cache Poisoning Attempt', {\n                    'ip_address': src_ip,\n                    'previous_mac': known_mac,\n                    'new_mac': src_mac,\n                    'action': 'IP-to-MAC mapping changed unexpectedly',\n                })\n                return True\n        return False\n\n    def check_flip_flop(self, src_ip: str, src_mac: str):\n        \"\"\"Check for MAC address flip-flopping (active attack indicator).\"\"\"\n        self.arp_history[src_ip].append((src_mac, time.time()))\n\n        # Keep only last 60 seconds of history\n        cutoff = time.time() - 60\n        self.arp_history[src_ip] = [\n            (mac, ts) for mac, ts in self.arp_history[src_ip]\n            if ts > cutoff\n        ]\n\n        unique_macs = set(mac for mac, ts in self.arp_history[src_ip])\n        if len(unique_macs) > 2:\n            self.alert('CRITICAL', 'ARP Flip-Flop Detected (Active Attack)', {\n                'ip_address': src_ip,\n                'mac_addresses': list(unique_macs),\n                'changes_in_60s': len(self.arp_history[src_ip]),\n            })\n            return True\n        return False\n\n    def check_arp_rate(self, src_mac: str):\n        \"\"\"Check for ARP flood (DoS or scanning).\"\"\"\n        self.arp_count[src_mac] += 1\n\n        # Reset counters every 10 seconds\n        if time.time() - self.last_reset > 10:\n            for mac, count in self.arp_count.items():\n                if count > self.arp_rate_threshold:\n                    self.alert('MEDIUM', 'ARP Flood Detected', {\n                        'source_mac': mac,\n                        'arp_packets_10s': count,\n                        'threshold': self.arp_rate_threshold,\n                    })\n            self.arp_count.clear()\n            self.last_reset = time.time()\n\n    def process_packet(self, packet):\n        \"\"\"Process captured ARP packet.\"\"\"\n        if not packet.haslayer(ARP):\n            return\n\n        arp = packet[ARP]\n\n        # Only process ARP replies (opcode 2) and requests (opcode 1)\n        if arp.op not in (1, 2):\n            return\n\n        src_ip = arp.psrc\n        src_mac = arp.hwsrc.lower()\n\n        # Run detection checks\n        self.check_gateway_spoofing(src_ip, src_mac)\n        self.check_mac_change(src_ip, src_mac)\n        self.check_flip_flop(src_ip, src_mac)\n        self.check_arp_rate(src_mac)\n\n        # Update ARP table\n        self.arp_table[src_ip] = src_mac\n\n    def start_monitoring(self):\n        \"\"\"Start real-time ARP monitoring.\"\"\"\n        print(f\"[*] Starting ARP Poison Detection on {self.interface}\")\n        print(f\"[*] Gateway: {self.gateway_ip} ({self.gateway_mac})\")\n        print(f\"[*] Monitoring... (Ctrl+C to stop)\\n\")\n\n        if SCAPY_AVAILABLE:\n            sniff(\n                iface=self.interface,\n                filter=\"arp\",\n                prn=self.process_packet,\n                store=False,\n            )\n        else:\n            print(\"[-] Scapy not available. Install with: pip install scapy\")\n            print(\"[*] Falling back to tcpdump-based monitoring...\")\n            self._monitor_with_tcpdump()\n\n    def _monitor_with_tcpdump(self):\n        \"\"\"Fallback monitoring using tcpdump.\"\"\"\n        cmd = ['tcpdump', '-i', self.interface, '-l', '-n', 'arp']\n        proc = subprocess.Popen(cmd, stdout=subprocess.PIPE,\n                                stderr=subprocess.DEVNULL, text=True)\n        try:\n            for line in proc.stdout:\n                parts = line.strip().split()\n                if 'is-at' in parts:\n                    try:\n                        ip_idx = parts.index('is-at') - 1\n                        mac_idx = parts.index('is-at') + 1\n                        src_ip = parts[ip_idx]\n                        src_mac = parts[mac_idx].lower()\n                        self.check_gateway_spoofing(src_ip, src_mac)\n                        self.check_mac_change(src_ip, src_mac)\n                        self.arp_table[src_ip] = src_mac\n                    except (IndexError, ValueError):\n                        continue\n        except KeyboardInterrupt:\n            proc.terminate()\n\n    def generate_report(self) -> dict:\n        \"\"\"Generate summary report of detected anomalies.\"\"\"\n        return {\n            'monitoring_interface': self.interface,\n            'gateway': {'ip': self.gateway_ip, 'mac': self.gateway_mac},\n            'total_alerts': len(self.alerts),\n            'arp_table_size': len(self.arp_table),\n            'alerts': self.alerts,\n        }\n\n\nif __name__ == '__main__':\n    if len(sys.argv) \u003C 4:\n        print(\"Usage: python process.py \u003Cinterface> \u003Cgateway_ip> \u003Cgateway_mac>\")\n        print(\"Example: python process.py eth0 10.0.1.1 aa:bb:cc:dd:ee:01\")\n        sys.exit(1)\n\n    detector = ARPPoisonDetector(\n        interface=sys.argv[1],\n        gateway_ip=sys.argv[2],\n        gateway_mac=sys.argv[3],\n    )\n\n    try:\n        detector.start_monitoring()\n    except KeyboardInterrupt:\n        print(\"\\n\\n[*] Monitoring stopped.\")\n        report = detector.generate_report()\n        print(f\"[*] Total alerts generated: {report['total_alerts']}\")\n        print(f\"[*] ARP table entries: {report['arp_table_size']}\")\n```\n\n## Prevention Measures\n\n### Layer 2 Controls\n\n1. **Dynamic ARP Inspection (DAI)** - Validates ARP packets against DHCP snooping binding table\n2. **DHCP Snooping** - Builds trusted IP-MAC-port binding database\n3. **Port Security** - Limits MAC addresses per port\n4. **Private VLANs** - Restricts communication between hosts in the same VLAN\n\n### Network Controls\n\n1. **Static ARP Entries** - For critical infrastructure (gateways, DNS, DHCP)\n2. **Network Segmentation** - Reduce broadcast domain size with VLANs\n3. **802.1X Authentication** - Authenticate devices before network access\n4. **Encrypted Protocols** - Use SSH, HTTPS, TLS to protect data even if intercepted\n\n## Best Practices\n\n- **Defense in Depth** - Combine DAI, ARPWatch, and custom monitoring for comprehensive coverage\n- **DHCP Snooping First** - Always enable DHCP snooping before DAI (DAI depends on snooping database)\n- **Static ARP for Gateways** - Configure static ARP entries on critical servers for the default gateway\n- **Monitor Gratuitous ARP** - Pay special attention to unsolicited ARP replies\n- **Small Broadcast Domains** - Use VLANs to limit the scope of ARP-based attacks\n- **Regular Audits** - Periodically compare ARP tables across devices to identify anomalies\n\n## References\n\n- [NIST SP 800-54 - Border Gateway Protocol Security](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-54\u002Ffinal)\n- [Cisco DAI Configuration Guide](https:\u002F\u002Fwww.cisco.com\u002Fc\u002Fen\u002Fus\u002Ftd\u002Fdocs\u002Fswitches\u002Flan\u002Fcatalyst9300\u002Fsoftware\u002Frelease\u002F16-12\u002Fconfiguration_guide\u002Fsec\u002Fb_1612_sec_9300_cg\u002Fconfiguring_dynamic_arp_inspection.html)\n- [Comparitech ARP Poisoning Guide](https:\u002F\u002Fwww.comparitech.com\u002Fblog\u002Finformation-security\u002Farp-poisoning-spoofing-detect-prevent\u002F)\n- [Okta ARP Poisoning Techniques](https:\u002F\u002Fwww.okta.com\u002Fidentity-101\u002Farp-poisoning\u002F)\n","# Detecting ARP Poisoning in Network Traffic\n\n## Overview\n\nARP poisoning (ARP spoofing) is a Layer 2 attack where an adversary sends falsified ARP messages to associate their MAC address with the IP address of a legitimate host, enabling man-in-the-middle (MitM) interception, session hijacking, or denial of service. Since ARP has no built-in authentication mechanism, any device on a broadcast domain can forge ARP replies. Detection requires monitoring ARP traffic for anomalies such as gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses. This skill covers deploying multiple detection layers including ARPWatch, Dynamic ARP Inspection (DAI), Wireshark-based analysis, and custom Python monitoring tools.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting arp poisoning in network traffic\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Access to the target network segment (broadcast domain)\n- Linux host for ARPWatch and custom monitoring tools\n- Managed switches supporting Dynamic ARP Inspection (Cisco Catalyst, Aruba, Juniper EX)\n- Wireshark or tcpdump for packet capture\n- DHCP snooping configured (prerequisite for DAI)\n- Network monitoring infrastructure (SIEM, syslog server)\n\n## Core Concepts\n\n### ARP Protocol Fundamentals\n\nARP maps IP addresses to MAC addresses on a local network segment. The protocol operates statelessly with no authentication:\n\n```\nNormal ARP Process:\n1. Host A broadcasts: \"Who has 10.0.1.1? Tell 10.0.1.100\"\n2. Router replies: \"10.0.1.1 is at AA:BB:CC:DD:EE:01\"\n3. Host A caches the mapping\n\nARP Poisoning Attack:\n1. Attacker sends unsolicited ARP reply to Host A:\n   \"10.0.1.1 is at EV:IL:MA:CA:DD:RR\" (attacker's MAC)\n2. Host A updates cache, sends traffic to attacker\n3. Attacker forwards to real gateway (MitM position)\n```\n\n### Attack Indicators\n\n| Indicator | Description | Severity |\n|-----------|-------------|----------|\n| MAC flip-flopping | Same IP mapped to different MACs rapidly | High |\n| Gratuitous ARP flood | Unsolicited ARP replies targeting multiple hosts | High |\n| Duplicate IP address | Two different MACs claiming same IP | Critical |\n| Unusual ARP volume | Spike in ARP packets per second | Medium |\n| ARP from non-DHCP source | Static IP claims from unknown devices | Medium |\n| Gateway MAC change | Default gateway MAC address changed | Critical |\n\n## Workflow\n\n### Step 1: Deploy ARPWatch for Continuous Monitoring\n\n```bash\n# Install ARPWatch\nsudo apt-get install -y arpwatch\n\n# Configure ARPWatch\nsudo vi \u002Fetc\u002Fdefault\u002Farpwatch\n# INTERFACES=\"eth0\"\n# ARGS=\"-N -p -i eth0 -f \u002Fvar\u002Flib\u002Farpwatch\u002Farp.dat\"\n\n# Start monitoring\nsudo systemctl enable arpwatch\nsudo systemctl start arpwatch\n\n# View current ARP database\ncat \u002Fvar\u002Flib\u002Farpwatch\u002Farp.dat\n\n# Monitor logs for changes\ntail -f \u002Fvar\u002Flog\u002Fsyslog | grep arpwatch\n```\n\nARPWatch alert types:\n- **new station** - Previously unseen MAC address\n- **changed ethernet address** - IP mapped to different MAC (potential poisoning)\n- **flip flop** - MAC alternating between two addresses (active attack)\n- **reused old ethernet address** - Previously seen mapping returned\n\n### Step 2: Configure Dynamic ARP Inspection (DAI) on Switches\n\n**Cisco Catalyst configuration:**\n\n```\n! Enable DHCP snooping (prerequisite for DAI)\nip dhcp snooping\nip dhcp snooping vlan 10,20,30\n\n! Configure trusted ports (uplinks, DHCP servers)\ninterface GigabitEthernet1\u002F0\u002F1\n description Uplink to Distribution\n ip dhcp snooping trust\n\ninterface GigabitEthernet1\u002F0\u002F48\n description DHCP Server\n ip dhcp snooping trust\n\n! Enable Dynamic ARP Inspection\nip arp inspection vlan 10,20,30\n\n! Configure trusted ports for DAI\ninterface GigabitEthernet1\u002F0\u002F1\n ip arp inspection trust\n\n! Set rate limits to prevent ARP flood DoS\ninterface range GigabitEthernet1\u002F0\u002F2-47\n ip arp inspection limit rate 15\n\n! Enable additional validation checks\nip arp inspection validate src-mac dst-mac ip\n\n! Configure ARP ACL for static IP devices (servers, printers)\narp access-list STATIC-ARP-ENTRIES\n permit ip host 10.0.10.100 mac host 0011.2233.4455\n permit ip host 10.0.10.101 mac host 0011.2233.4456\n\nip arp inspection filter STATIC-ARP-ENTRIES vlan 10\n\n! Verify DAI status\nshow ip arp inspection vlan 10\nshow ip arp inspection statistics\nshow ip dhcp snooping binding\n```\n\n### Step 3: Wireshark Detection Filters\n\n```\n# Detect gratuitous ARP (sender and target IP are the same)\narp.src.proto_ipv4 == arp.dst.proto_ipv4\n\n# Detect ARP replies (focus on unsolicited)\narp.opcode == 2\n\n# Detect duplicate IP address claims\narp.duplicate-address-detected\n\n# Detect ARP packets from specific attacker MAC\neth.src == ev:il:ma:ca:dd:rr\n\n# Detect ARP storms (high volume)\n# Use Statistics > I\u002FO Graphs > Display filter: arp\n\n# Detect gateway impersonation\narp.src.proto_ipv4 == 10.0.1.1 && arp.src.hw_mac != aa:bb:cc:dd:ee:01\n```\n\n### Step 4: Custom Python ARP Monitor\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"\nReal-time ARP poisoning detection using packet capture.\nMonitors ARP traffic for spoofing indicators and alerts on anomalies.\n\"\"\"\n\nimport subprocess\nimport sys\nimport json\nimport time\nfrom collections import defaultdict\nfrom datetime import datetime\n\ntry:\n    from scapy.all import sniff, ARP, Ether, get_if_hwaddr, conf\n    SCAPY_AVAILABLE = True\nexcept ImportError:\n    SCAPY_AVAILABLE = False\n\n\nclass ARPPoisonDetector:\n    def __init__(self, interface: str, gateway_ip: str, gateway_mac: str):\n        self.interface = interface\n        self.gateway_ip = gateway_ip\n        self.gateway_mac = gateway_mac.lower()\n        self.arp_table = {}  # IP -> MAC mapping\n        self.arp_history = defaultdict(list)  # IP -> list of (MAC, timestamp)\n        self.alerts = []\n        self.arp_count = defaultdict(int)  # Source MAC -> count per interval\n        self.last_reset = time.time()\n        self.arp_rate_threshold = 50  # ARP packets per 10 seconds\n\n    def alert(self, severity: str, message: str, details: dict):\n        \"\"\"Generate alert for detected anomaly.\"\"\"\n        alert_data = {\n            'timestamp': datetime.now().isoformat(),\n            'severity': severity,\n            'message': message,\n            'details': details,\n        }\n        self.alerts.append(alert_data)\n        print(f\"\\n[{severity}] {datetime.now().strftime('%H:%M:%S')} - {message}\")\n        for key, value in details.items():\n            print(f\"  {key}: {value}\")\n\n    def check_gateway_spoofing(self, src_ip: str, src_mac: str):\n        \"\"\"Check if someone is spoofing the gateway.\"\"\"\n        if src_ip == self.gateway_ip and src_mac != self.gateway_mac:\n            self.alert('CRITICAL', 'Gateway ARP Spoofing Detected', {\n                'gateway_ip': self.gateway_ip,\n                'expected_mac': self.gateway_mac,\n                'spoofed_mac': src_mac,\n                'action': 'Potential MitM attack on default gateway',\n            })\n            return True\n        return False\n\n    def check_mac_change(self, src_ip: str, src_mac: str):\n        \"\"\"Check if IP-to-MAC mapping has changed.\"\"\"\n        if src_ip in self.arp_table:\n            known_mac = self.arp_table[src_ip]\n            if known_mac != src_mac:\n                self.alert('HIGH', 'ARP Cache Poisoning Attempt', {\n                    'ip_address': src_ip,\n                    'previous_mac': known_mac,\n                    'new_mac': src_mac,\n                    'action': 'IP-to-MAC mapping changed unexpectedly',\n                })\n                return True\n        return False\n\n    def check_flip_flop(self, src_ip: str, src_mac: str):\n        \"\"\"Check for MAC address flip-flopping (active attack indicator).\"\"\"\n        self.arp_history[src_ip].append((src_mac, time.time()))\n\n        # Keep only last 60 seconds of history\n        cutoff = time.time() - 60\n        self.arp_history[src_ip] = [\n            (mac, ts) for mac, ts in self.arp_history[src_ip]\n            if ts > cutoff\n        ]\n\n        unique_macs = set(mac for mac, ts in self.arp_history[src_ip])\n        if len(unique_macs) > 2:\n            self.alert('CRITICAL', 'ARP Flip-Flop Detected (Active Attack)', {\n                'ip_address': src_ip,\n                'mac_addresses': list(unique_macs),\n                'changes_in_60s': len(self.arp_history[src_ip]),\n            })\n            return True\n        return False\n\n    def check_arp_rate(self, src_mac: str):\n        \"\"\"Check for ARP flood (DoS or scanning).\"\"\"\n        self.arp_count[src_mac] += 1\n\n        # Reset counters every 10 seconds\n        if time.time() - self.last_reset > 10:\n            for mac, count in self.arp_count.items():\n                if count > self.arp_rate_threshold:\n                    self.alert('MEDIUM', 'ARP Flood Detected', {\n                        'source_mac': mac,\n                        'arp_packets_10s': count,\n                        'threshold': self.arp_rate_threshold,\n                    })\n            self.arp_count.clear()\n            self.last_reset = time.time()\n\n    def process_packet(self, packet):\n        \"\"\"Process captured ARP packet.\"\"\"\n        if not packet.haslayer(ARP):\n            return\n\n        arp = packet[ARP]\n\n        # Only process ARP replies (opcode 2) and requests (opcode 1)\n        if arp.op not in (1, 2):\n            return\n\n        src_ip = arp.psrc\n        src_mac = arp.hwsrc.lower()\n\n        # Run detection checks\n        self.check_gateway_spoofing(src_ip, src_mac)\n        self.check_mac_change(src_ip, src_mac)\n        self.check_flip_flop(src_ip, src_mac)\n        self.check_arp_rate(src_mac)\n\n        # Update ARP table\n        self.arp_table[src_ip] = src_mac\n\n    def start_monitoring(self):\n        \"\"\"Start real-time ARP monitoring.\"\"\"\n        print(f\"[*] Starting ARP Poison Detection on {self.interface}\")\n        print(f\"[*] Gateway: {self.gateway_ip} ({self.gateway_mac})\")\n        print(f\"[*] Monitoring... (Ctrl+C to stop)\\n\")\n\n        if SCAPY_AVAILABLE:\n            sniff(\n                iface=self.interface,\n                filter=\"arp\",\n                prn=self.process_packet,\n                store=False,\n            )\n        else:\n            print(\"[-] Scapy not available. Install with: pip install scapy\")\n            print(\"[*] Falling back to tcpdump-based monitoring...\")\n            self._monitor_with_tcpdump()\n\n    def _monitor_with_tcpdump(self):\n        \"\"\"Fallback monitoring using tcpdump.\"\"\"\n        cmd = ['tcpdump', '-i', self.interface, '-l', '-n', 'arp']\n        proc = subprocess.Popen(cmd, stdout=subprocess.PIPE,\n                                stderr=subprocess.DEVNULL, text=True)\n        try:\n            for line in proc.stdout:\n                parts = line.strip().split()\n                if 'is-at' in parts:\n                    try:\n                        ip_idx = parts.index('is-at') - 1\n                        mac_idx = parts.index('is-at') + 1\n                        src_ip = parts[ip_idx]\n                        src_mac = parts[mac_idx].lower()\n                        self.check_gateway_spoofing(src_ip, src_mac)\n                        self.check_mac_change(src_ip, src_mac)\n                        self.arp_table[src_ip] = src_mac\n                    except (IndexError, ValueError):\n                        continue\n        except KeyboardInterrupt:\n            proc.terminate()\n\n    def generate_report(self) -> dict:\n        \"\"\"Generate summary report of detected anomalies.\"\"\"\n        return {\n            'monitoring_interface': self.interface,\n            'gateway': {'ip': self.gateway_ip, 'mac': self.gateway_mac},\n            'total_alerts': len(self.alerts),\n            'arp_table_size': len(self.arp_table),\n            'alerts': self.alerts,\n        }\n\n\nif __name__ == '__main__':\n    if len(sys.argv) \u003C 4:\n        print(\"Usage: python process.py \u003Cinterface> \u003Cgateway_ip> \u003Cgateway_mac>\")\n        print(\"Example: python process.py eth0 10.0.1.1 aa:bb:cc:dd:ee:01\")\n        sys.exit(1)\n\n    detector = ARPPoisonDetector(\n        interface=sys.argv[1],\n        gateway_ip=sys.argv[2],\n        gateway_mac=sys.argv[3],\n    )\n\n    try:\n        detector.start_monitoring()\n    except KeyboardInterrupt:\n        print(\"\\n\\n[*] Monitoring stopped.\")\n        report = detector.generate_report()\n        print(f\"[*] Total alerts generated: {report['total_alerts']}\")\n        print(f\"[*] ARP table entries: {report['arp_table_size']}\")\n```\n\n## Prevention Measures\n\n### Layer 2 Controls\n\n1. **Dynamic ARP Inspection (DAI)** - Validates ARP packets against DHCP snooping binding table\n2. **DHCP Snooping** - Builds trusted IP-MAC-port binding database\n3. **Port Security** - Limits MAC addresses per port\n4. **Private VLANs** - Restricts communication between hosts in the same VLAN\n\n### Network Controls\n\n1. **Static ARP Entries** - For critical infrastructure (gateways, DNS, DHCP)\n2. **Network Segmentation** - Reduce broadcast domain size with VLANs\n3. **802.1X Authentication** - Authenticate devices before network access\n4. **Encrypted Protocols** - Use SSH, HTTPS, TLS to protect data even if intercepted\n\n## Best Practices\n\n- **Defense in Depth** - Combine DAI, ARPWatch, and custom monitoring for comprehensive coverage\n- **DHCP Snooping First** - Always enable DHCP snooping before DAI (DAI depends on snooping database)\n- **Static ARP for Gateways** - Configure static ARP entries on critical servers for the default gateway\n- **Monitor Gratuitous ARP** - Pay special attention to unsolicited ARP replies\n- **Small Broadcast Domains** - Use VLANs to limit the scope of ARP-based attacks\n- **Regular Audits** - Periodically compare ARP tables across devices to identify anomalies\n\n## References\n\n- [NIST SP 800-54 - Border Gateway Protocol Security](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-54\u002Ffinal)\n- [Cisco DAI Configuration Guide](https:\u002F\u002Fwww.cisco.com\u002Fc\u002Fen\u002Fus\u002Ftd\u002Fdocs\u002Fswitches\u002Flan\u002Fcatalyst9300\u002Fsoftware\u002Frelease\u002F16-12\u002Fconfiguration_guide\u002Fsec\u002Fb_1612_sec_9300_cg\u002Fconfiguring_dynamic_arp_inspection.html)\n- [Comparitech ARP Poisoning Guide](https:\u002F\u002Fwww.comparitech.com\u002Fblog\u002Finformation-security\u002Farp-poisoning-spoofing-detect-prevent\u002F)\n- [Okta ARP Poisoning Techniques](https:\u002F\u002Fwww.okta.com\u002Fidentity-101\u002Farp-poisoning\u002F)\n",{"name":5,"tags":47,"author":48,"domain":40,"license":15,"version":49,"nist_csf":50,"subdomain":35,"description":7,"mitre_attack":55},[32,31,26,30,29,35,28,27],"mahipal","1.0",[51,52,53,54],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[56,57,58,59],"T1557.002","T1557","T1040","T1200","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-arp-poisoning-in-network-traffic",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-arp-poisoning-in-network-traffic",{"tool":76,"command":77},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-arp-poisoning-in-network-traffic",{"tool":79,"command":80},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-arp-poisoning-in-network-traffic","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-arp-poisoning-in-network-traffic\u002FSKILL.md",true,[84,89,95],{"path":85,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-arp-poisoning-in-network-traffic\u002FLICENSE",{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fapi-reference.md","REFERENCE","参考文档",1759,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-arp-poisoning-in-network-traffic\u002Freferences\u002Fapi-reference.md",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fagent.py","SCRIPT","脚本",7137,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-arp-poisoning-in-network-traffic\u002Fscripts\u002Fagent.py",[102,127,151,178,204,231],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":109,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[108],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[110,111,112,113,41,40,114,115,39,116,117,118,119,120,121,122,123,124,125,126],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[133],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[135,123,136,137,41,138,40,39,139,140,141,142,143,144,145,146,147,148,149,150],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[157,160],{"categoryNo":158,"categoryName":159,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,162,163,164,165,40,166,167,139,168,169,170,171,172,33,173,174,175,176,177],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":185,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[184],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[186,187,188,40,189,190,191,192,193,194,195,196,197,198,199,200,142,201,202,203],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,40,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[237],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[41,239,40,240,241,242,37,243,244,245,246,173,247,174,248,249,250,251,252,253],"triaging security incident","siem","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]