Detecting ARP Spoofing Attacks Against OpenSSH Linux Servers Through ARP Table Integrity and Network Traffic Monitoring

Enterprise Linux servers commonly provide remote administration services through OpenSSH. These servers communicate with administrators and other infrastructure systems over local networks.

A weakness in local network address resolution can allow an attacker to perform an ARP Spoofing attack, in which forged ARP messages associate the attacker's MAC address with the IP address of another system.

If successful, network traffic intended for the OpenSSH server or administrator workstation may be redirected through the attacker's system. This can enable traffic interception, session disruption, or man-in-the-middle conditions.

In this use case, an OpenSSH Linux server is deployed in an isolated enterprise-style laboratory environment using Ubuntu Linux. Kali Linux is used as the controlled security-testing system.

The ARP Spoofing attack is simulated against the controlled network using Ettercap. Wireshark is used to inspect ARP traffic, while arpwatch monitors changes in IP-to-MAC address relationships. Suricata provides network security monitoring and alerting.

The defensive mechanism focuses on detecting unexpected ARP mappings, identifying duplicate or changing MAC addresses, monitoring suspicious ARP traffic, and generating security alerts when ARP-based network manipulation is detected.

After implementing the controls, the ARP Spoofing assessment is repeated to verify that the attack is detected and that the OpenSSH server's network communication remains protected.

OpenSSH provides secure remote administration for Linux servers through encrypted SSH communication. Although SSH encrypts application-layer communication, the underlying network can still be targeted through ARP-based attacks.

ARP does not inherently provide authentication for IP-to-MAC address mappings. An attacker who has access to the same local network segment may send forged ARP messages to influence how systems associate IP addresses with MAC addresses.

The security problem occurs when ARP mappings change unexpectedly, a server IP becomes associated with an unknown MAC address, multiple systems claim the same IP address, the gateway MAC address changes unexpectedly, large numbers of unsolicited ARP replies are generated, or network traffic begins passing through an unauthorized intermediary. If these conditions are not monitored, an attacker may establish a man-in-the-middle position between an administrator workstation and an OpenSSH server.

The security problem is therefore:

The proposed solution introduces ARP mapping monitoring, packet-level inspection, network intrusion detection, trusted ARP baselining, network segmentation, security-event monitoring, and security alerting to identify suspicious ARP behavior.

ARP Spoofing is a local-network attack in which an attacker sends forged ARP messages to associate their MAC address with the IP address of another network device. In this controlled assessment, the attacker system is placed on the same isolated virtual network as the OpenSSH server.

The assessment focuses on unexpected ARP replies, IP-to-MAC address changes, duplicate IP-to-MAC relationships, repeated unsolicited ARP responses, gateway MAC-address changes, and suspicious ARP traffic patterns.

The security concept is based on continuously monitoring the relationship between IP addresses and MAC addresses on the protected network.

The security monitoring system maintains awareness of expected IP-to-MAC relationships and compares observed ARP behavior against the established network baseline. The assessment focuses on ARP mapping validation, ARP traffic inspection, MAC address changes, duplicate mappings, network security monitoring, and suspicious ARP activity.

The secure processing flow is: