Detecting and Preventing VM-based and Mininet-based ARP Spoofing Attacks using Scapy

Local area networks are vulnerable to Address Resolution Protocol (ARP) spoofing, a serious security risk when an attacker sends fictitious ARP packets to link their Medium Access Control (MAC) address to the IP address of another host, allowing for a variety of malicious operations. This study looks at Scapy-based ARP spoofing detection and mitigation techniques, concentrating on two different approaches. The first method simulates a local network environment by creating a custom topology using the Mininet network simulator. We devised method of detecting and later containing the spoof MAC address for the purpose of reverting the correct MAC address back to the IP address that was affected. One of the host in this topology was spoofed using Scapy. Additionally, we implemented an anti-spoofing Flask and logging systems that help in tracking and recording cases of spoofing. The second method employs two Virtual Machines, one Ubuntu and the other Kali Linux and both on the same Wireless Application Protocol(WAP) making it a realistic setup. In this setup, one virtual machine is Ubuntu and the other is Kali, and the latter performs ARP spoofing on the former; at the same time, Ubuntu has a Python program using Scapy to detect and respond to the attacks. Thus, the approach of this research, which provides a detailed analysis of ARP spoofing scenarios and demonstrates effective detection and prevention measures in virtual and actual environments, enhances the protection against ARP spoofing attacks to the system connected in a network.