ARP Security Research

Overview

ARP Security Research is a Python project that demonstrates how Address Resolution Protocol (ARP) cache poisoning works in a controlled laboratory environment.

Using Scapy, the project crafts forged ARP replies to illustrate how Layer 2 attacks can redirect network traffic. The primary objective is to help students and security professionals understand ARP spoofing techniques and corresponding defensive measures.

This project is intended strictly for educational purposes, defensive cybersecurity research, and authorized penetration testing.

---

Features

• Performs ARP cache poisoning
• Crafts custom ARP reply packets
• Demonstrates Man-in-the-Middle attack concepts
• Uses Scapy for packet creation
• Lightweight implementation
• Suitable for cybersecurity labs

---

Technologies

• Python 3
• Scapy
• Linux

---

Repository Structure

arp-security-research/
│
├── arp_spoofer.py
├── requirements.txt
└── README.md

---

Requirements

• Python 3.9+
• Scapy
• Linux
• Root privileges

Install dependencies:

pip install -r requirements.txt

or

pip install scapy

---

Usage

Example:

sudo python3 arp_spoofer.py

Depending on the implementation, you may need to specify target and gateway IP addresses.

---

How It Works

1. Discover the MAC address of the target.
2. Discover the MAC address of the gateway.
3. Send forged ARP replies.
4. Convince each host that your machine owns the other's IP address.
5. Forward traffic (optional) to maintain connectivity.

---

Learning Objectives

This project demonstrates:

• Address Resolution Protocol (ARP)
• Layer 2 networking
• ARP cache poisoning
• Packet crafting with Scapy
• Network attack simulation
• Defensive security research

---

Ethical Use

This project must only be used on:

• Personal laboratory environments
• Capture The Flag (CTF) competitions
• Authorized penetration tests
• Networks where explicit permission has been granted

Unauthorized use against third-party systems may be illegal.

---

Future Improvements

• Command-line interface
• Automatic target discovery
• Gateway detection
• Network scanning integration
• Logging
• IPv6 Neighbor Discovery research
• Unit tests

---

Defensive Countermeasures

The attack demonstrated in this project can be mitigated through:

• Dynamic ARP Inspection (DAI)
• Static ARP entries
• Port security
• VLAN segmentation
• ARP monitoring tools
• Network intrusion detection systems

---

Contributing

Pull requests and suggestions are welcome.

---

Author

Rhema Great

GitHub: https://github.com/RhemaGreat

---

License

Licensed under the MIT License.