Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Although we have not had any first-hand experience with these kind of attacks (as far as we know of) I would like to know how to prevent them from happening as much as possible. I mostly use my personal laptop myself and also take it to clients when I'm on the road. I have used the XArp on my laptop before to monitor suspicious behaviour on the network but have not encountered any.

  • Is APR at all a security risk to take into account in small business setups?
  • If so, what are the main risks and how can one optimally counter them?
  • When connecting to a foreign network (for example, when on location at at client), should I consider this risk and what could I possibly do to counter it?
share|improve this question
Typo -- you wrote "APR" instead of "ARP" in your question – Eddie May 4 '09 at 15:35
Replaced the apr tag with arp-poisoning. My expectation for the apr tag would be Apache Portable Runtime. – Mihai Limbăşan May 4 '09 at 22:17
up vote 3 down vote accepted

The likelihood of these types of attacks increases if the information passing through your network is valuable and others know it exists.

The risks are that information can be stolen. This information could be used to damage your IT infrastructure or damage your company's business if it is trade secrets, client lists, or similar information.

When connecting to a foreign network, always use encryption. Use VPN connections and https websites. If that data is encrypted, even if the attacker is getting your data, it will be incredibly difficult to use. Remember that programs on computers like to run in the background and pass data such as usernames and passwords.

I highly suggest getting Wireshark and examining the data that passes through your network connection. Browse some webpages, open some applications, etc. and see if you can see information in the packets that you would not want someone to know such as your password or an internal company website.

If you really want to know what can be done to counter these type of attacks locally, I'd suggest the book LAN Switch Security: What Hackers Know About Your Switches.

share|improve this answer

use a VPN or encryption to prevent people from sniffing your traffic in a hostile environment. you can also make a static arp entry in your windows machine if you know the right MAC address of the router with:

arp -s <gw_ip> <gw_mac>

at my environment i have a software called arpwatch on the firewall to see if someone play tricks on my network.

you can also consider implementing somekind of NAC(Network Access Control) at your Switches to prevent unauthorized clients on your network.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.