# PrECast: An Efficient Crypto-Free Solution for Broadcast-Based Attacks in IPv4 Networks
## 3 Mitigating the ARP-Poisoning Attack
### Hardware-Based Solution  
From the key papers reviewed in Section 3.1, it is apparent that every algorithm-based solution requires either a modification to the protocol stack and/or the use of heavy cryptographic tools, along with previously-established stateful information between a host and the network. Thus, they may not support BYOD concepts. Cisco introduced a hardware-based solution to address this security concern. Their algorithm runs on their switches and routers and thus does not need any modification at the client device. Cisco [18] introduced a number of security features in their switches to protect a LAN. DHCP snooping protects the network from rogue DHCP servers. The network administrator configures the port to which a legitimate DHCP server is connected as a trusted port. The remaining ports are configured as untrusted ports. The switch will drop all DHCP-server messages that originate from untrusted ports. The switch also builds and maintains a DHCP binding database that consists of the MAC address, IP address, lease time, binding type, VLAN and interface-ID. In a DHCP-exhaustion attack, an attacker can exhaust the pool of available IP addresses of the DHCP server within seconds. This is done by flooding DHCP-discover packets requesting new IP addresses. The DHCP-snooping technique does not only mitigate rogue DHCP servers, but also defends against DHCP-exhaustion attacks. Even if switch-port security is in place, tools such as Yersinia or dhcpstarv are used to randomize the field Client Hardware Address (CHADDR) inside the DHCP payload to send multiple DHCP-requests [19]. This process exhausts the DHCP address space within a short time. However, DHCP-snooping is clever enough to read the payload of the DHCP protocol and verify that the source MAC address and CHADDR are the same to defeat such starvation attacks. This extra feature needs to be enabled through an optional command. Cisco's patented Dynamic ARP Inspection (DAI) [18] is a security feature currently built into their switches that validates ARP packets in a network. DAI intercepts, logs and discards ARP packets with invalid IP-to-MAC address bindings. This capability protects the network from Layer-2 MITM attacks. The DAI feature learns the <MAC, IP >binding from the DHCP-snooping table. Even though the DAI feature solves the ARP-poisoning problem in a LAN, it still has the following problems:  
* In a stacked switch environment, DHCP-snooping is managed on the stack master. When a new switch joins the stack, the switch receives the DHCP-snooping configuration from the stack master. Whenever a member leaves the stack, all DHCP-snooping address bindings associated with the switch age out. However, in a non-stacked multi-layered environment, DHCP-snooping is hard to implement. * As mentioned in [20], many network components require changing MAC addresses. Therefore, care should be taken when defining protections against ARP-poisoning. This includes the Hot Standby Router Protocol (HSRP), hosts configured with load balancing solutions such as Microsoft NLB (Network Load Balancing), clustering solutions, and so on. However, disabling the DAI feature on these ports could weaken the security. An intelligent attacker may exploit this weakness and launch an attack. * As we mentioned before, DAI learns the legitimate <MAC, IP >bindings from the DHCP-snooping database. Thus, all static <MAC, IP >bindings must be manually entered into the DHCP-snooping database. For DAI, an Access Control List (ACL) must be created to include all static <MAC, IP >bindings. This process creates more overheads for the system administrator. Any change in the binding must be manually entered into the ACL. It is more common in an organization to assign static IP addresses to servers and printers. As soon as they are decommissioned, their bindings need to be removed from the ACL, as well as from the DHCP-snooping database. * The DHCP-snooping configuration requires a highly skilled network administrator when DHCP Option 82 is enabled.