ARP Bomb

Genian NAC 6.0 can detect high volumes of ARP request packets sent in a variety of ways. The Network Sensor counts how many ARP packets sent by each Node. If the ARP requests are sent more than the specified value, Genian NAC 6.0 suspects the ARP Bomb and designates the Node as critical.

Possible Causes

The following is a short list of some commonly known causes of elevated ARP traffic.

• Looped switch configuration

• Duplicate IP's on the Network

• Failing Network Interface in a device

• Invalid Subent Mask on a device

• Denial of Service attack leveraging ARP (typically from malware infected endpoints)

If an ARP Bomb anomaly is detected in your network, but you confirm that there is no problem, you can reduce the sensitivity of the ARP Bomb detection, or assign an exempt node group under the Policy > Node Policy > Anomaly Definition > ARP Bomb .

Configure Settings for ARP Bomb in Anomaly Definition

1. Go to Policy in the top panel.

2. Go to Policy > Node Policy > Anomaly Definition in the left Policy panel.

3. Click ARP Bomb.

4. Find Anomaly Event section to configure more options.

   • For Event Duration, optional setting to specify how long the ARP request packets are sent:

   • For Number of Allowable ARP Requests, optional setting to specify the threshold to trigger the anomaly detection.

   • For Attribute to Match, optional setting to find a Node sending the excessive ARP packets.

5. Click Update.

Create Node Group For ARP Bomb Nodes

1. Go to Policy in the top panel.

2. Go to Policy > Group > Node in the left Policy panel.

3. Click on Tasks > Create

4. For ID: ARP Packet Bombed.

5. For Status: Enabled.

6. For Boolean Operator select OR.

7. Find and click on Add in Condition section.

8. For each Anomaly you want to add use the followings:

   • Options: Anomaly.

   • Operator: Detected is one of.

   • Value: ARP Bomb.

9. Click Add.

10. Keep adding Conditions as needed.

11. Click Save.