Performing a conventional ARP Cache Poisoning attack will poison both the target host’s cache as well as the controller’s ARP cache. Proxy ARP helps reduce the amount of traffic in the network and also speeds up the response time for ARP replies.įor proxy ARP to function, the controller needs to implement it’s own ARP cache for hosts in the network. Once the controller has seen an ARP reply from a host, it can answer any ARP queries for that host itself using the information it learned from the ARP reply. Some controllers have leveraged this fact to build applications designed to reduce network traffic by having the controller respond to ARP queries itself. Regardless of which technique is used to handle ARP traffic, the controller should still end up observing all ARP messages. This method has the benefit of reducing DP to Control Plane (CP) traffic. A second flow is then installed for the ARP reply that follows. The controller then installs a flow in the network to allow that ARP message to go from the sender to the destination. When a host sends a new ARP message, a table-miss will occur on the adjacent switch and the switch will send the message to the controller as a packet-in.

Other controllers, like Floodlight, employ a more reactive forwarding method for ARP traffic. This way, no flow is actually installed in the network for that ARP traffic. The switch then delivers the ARP message to the destination host by forwarding it out the relevant switch port. When this technique is used the controller will send received ARP messages straight to the switch adjacent to the destination host as a packet-out message. Controllers like ONOS and OpenDaylight install static flow rules in switches to make sure all ARP traffic is sent to the controller as a packet-in message. In general, the network controller can be expected to observe any ARP traffic being sent in the network. However, the outcome of the attack is slightly different when it comes to SDN.

In-fact the attack can be carried out the exact same way.

ARP and SDNĪRP Cache Poisoning, or ARP Spoofing, is a problem in SDN networks the same way it’s a problem in conventional networks. This article will look at the attack in detail and the conditions necessary for the attack to be possible.

This attack results in the target host’s ARP cache being poisoned without the Software-Defined Network (SDN) controller observing the attack. The Data Plane (DP) ARP Cache Poisoning attack is the first attack, and the basis for the other attacks, featured in the paper “Exploiting Pitfalls in Software-Defined Networking Implementation”.

Arp poisoning software