Patent ID: 8782789
Filing Date: 2014-07-15
Classification: H04L

Abstract:
1. An Address Resolution Protocol (ARP) spoofing attack detection system, comprising: a receiver which receives a first ARP packet, and which determines whether the received first ARP packet is an unsolicited ARP packet; a transmitter which creates, in response to the received first ARP packet being determined as an unsolicited ARP packet, an ARP request packet which corresponds to the unsolicited ARP packet, and which broadcasts the created ARP request packet; a detector which determines, in response to an ARP response packet which corresponds to the broadcasted ARP request packet being received, whether an input port of the received ARP response packet is identical to an input port of the unsolicited ARP packet, and which determines that an ARP spoofing attack has occurred in response to the input port of the received ARP response packet being determined as not identical to the input port of the unsolicited ARP packet; and a packet information storage device which creates, in response to the received first ARP packet being determined as an unsolicited ARP packet, a first ARP pending entry which corresponds to the unsolicited ARP packet and includes the created first ARP pending entry in an ARP transaction table, and which includes unsolicited ARP packet information which includes information relating to the input port of the unsolicited ARP packet in the first ARP pending entry, wherein the detector determines whether unsolicited ARP packet information has been included in a second ARP pending entry which corresponds to the received ARP response packet and which second ARP pending entry is included in the ARP transaction table, and determines whether the input port of the received ARP response packet is identical to the input port of the unsolicited ARP packet included in the second ARP pending entry, in response to unsolicited ARP packet information having been included in the first ARP pending entry which corresponds to the received ARP response packet and which is stored in the ARP transaction table.