Patent ID: 6771649
Filing Date: 2004-08-03
Classification: H04L

Abstract:
An apparatus for detecting attempts to poison and preventing poisoning of an Address Resolution Protocol (ARP) cache, the apparatus comprising:a streams-based networking subsystem; a protocol stack, implemented in the streams-based networking subsystem, comprising: an ARP streams module capable of making resolution based upon the ARP cache; and a cache poisoning checker module for intercepting ARP traffic to and from the ARP streams module, the cache poisoning checker module adapted to record a destination Internet Protocol address for a second host contained in an ARP request from a first host, and determine whether an Internet Protocol address contained in the ARP response from the second host corresponds to the recorded destination Internet Protocol address for the second host, wherein the cache poisoning checker module can detect a spurious ARP response and prevent it from being entered in the ARP cache if the Internet Protocol address contained in the ARP response from the second host does not correspond to the recorded destination Internet Protocol address of the second host in the ARP request from the first host.