EXPERIMENTAL SIMULATION AND ANALYSIS OF LAYER 2 ATTACK VECTORS: ARP/DNS SPOOFING AND MITM: EXPERIMENTAL SIMULATION AND ANALYSIS OF LAYER 2 ATTACK VECTORS: ARP/DNS SPOOFING AND MITM

Denis Zvezdelinov; Zdravko Kuzmanov

doi:10.46687/jsar.v31i1.502

Authors

Denis Zvezdelinov Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: d.zvezdelinov@shu.bg
Zdravko Kuzmanov Department of Communication and Computer Engineering and Security Technologies, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: z.kuzmanov@shu.bg

DOI:

https://doi.org/10.46687/jsar.v31i1.502

Keywords:

ARP Spoofing, DNS Spoofing, Man-in-the-Middle (MITM), Data link (Layer 2), Network forenscics, Indicator of compromise (IoCs), Dynamic ARP Inspection

Abstract

This report examines the security of the Data Link Layer (Layer 2) of the OSI model, focusing on fundamental vulnerabilities in core local communication protocols. It addresses the concept of "implicit trust" inherent in the design of the Address Resolution Protocol (ARP) and the Domain Name System (DNS), which enables Man-in-the-Middle (MITM) attacks. The report analyzes the theoretical mechanisms of ARP cache poisoning and DNS spoofing. Network traffic was intercepted and subjected to forensic analysis through controlled simulations in an isolated laboratory environment. Key packet-level Indicators of Compromise (IoCs) were identified, including duplicate MAC addresses, an anomalous frequency of unsolicited ARP responses (Gratuitous ARP), and unusually low DNS resolution response times. In conclusion, architectural and software-based protective measures are outlined, including the implementation of Dynamic ARP Inspection (DAI), Port Security, and encrypted DNS protocols (DoH/DoT).

Author Biographies

Denis Zvezdelinov, Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: d.zvezdelinov@shu.bg

Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: d.zvezdelinov@shu.bg

Zdravko Kuzmanov, Department of Communication and Computer Engineering and Security Technologies, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: z.kuzmanov@shu.bg

Department of Communication and Computer Engineering and Security Technologies, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: z.kuzmanov@shu.bg

References

Arends, R., Austein, R., Larson, M., Massey, D., & Rose, S. (2005). DNS Security Introduction and Requirements. RFC 4033, Internet Engineering Task Force (IETF).

Bejtlich, R. (2013). The Practice of Network Security Monitoring: Understanding Incident Detection and Response. San Francisco.

Convery, S. (2004). Network Security Architectures. Indianapolis: Cisco Press.

Hoffman, P., & McManus, P. (2018). DNS Queries over HTTPS (DoH). RFC 8484, Internet Engineering Task Force (IETF).

Mockapetris, P. (1987). Domain Names - Implementation and Specification. RFC 1035, Internet Engineering Task Force (IETF).

Plummer, D. C. (1982). An Ethernet Address Resolution Protocol: Or Converting Network Protocol Addresses to 48.bit Ethernet Address for Transmission on Ethernet Hardware. RFC 826, Internet Engineering Task Force (IETF).

Stallings, W. (2021). Computer Security: Principles and Practice (4th ed.). Pearson.

Cisco Systems. (2021). Configuring Dynamic ARP Inspection (DAI). Catalyst Security Configuration Guide. [Online]. Available: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/guide/3750scg/swdynarp.html

Dimanova, D. “Theory of Modeling.” Journal Scientific and Applied Research, Vol. 4, 2013, pp. 106–111. [Online]. Available: https://doi.org/10.46687/jsar.v4i1.87.

Orru, A., & Valleri, A. (2022). Ettercap: A suite for man in the middle attacks. [Online]. Available: https://www.ettercap-project.org/.

EXPERIMENTAL SIMULATION AND ANALYSIS OF LAYER 2 ATTACK VECTORS: ARP/DNS SPOOFING AND MITM