Detecting ARP Spoofing Attacks

posted by  mneon (8)  16 months ago (blogs.technet.com)

After investigating an ARP spoofing incident recently, I started thinking of how we could easily ferret out this sort of information when responding to a potential incident.

In this particular case, there were two important parts of the attack:

1. ARP spoofing forced all traffic bound for the default gateway to be funneled through the infected machine, and
2. HTTP proxying allowed for the injection of malicious code in HTML documents.

ARP spoofi