The detection and prevention for ARP Spoofing based on Snort

As one of powerful and light weight Network Intrusion Detection System, Snort has good expansibility and transplantability, and can be used in various environments. However, Snort has clear deficiency on ARP spoofing detection, and its own ARP spoofing defense is powerless. To realize the detection and prevention of the ARP spoofing, the paper expanded the snort preprocessor plug-ins by adding an ARP detection module. Results shows this way can make Snort sniffer itself has immunity, and make locate the attacker more timely and accurately.