The Detecting and Preventing ARP Spoofing Based on Snort

Snort is one of a light weight,powerful NIDS.It can detect many different attack behaviors,and then give a real-time alarm.However,Snort has a clear defect in ARP spoofing detection,and its prevention against ARP spoofing is powerless.By expanding preprocessor plug-ins and adding an ARP detection module,the detection and defense of the ARP spoofing is achieved.