자동 노드 인식 기능을 갖는 ARP 스푸핑을 이용한 인터넷 차단기 = An Internet Stopper Using ARP Spoofing with Automatic Node Identification

다국어 초록 (Multilingual Abstract)

In this paper we describe an efficient and easy to use internet stopper, which is called AINS (Automatic Internet Stopper), which uses ARP spoofing scheme. Instead of forwarding packets to router for the case of hacking, in ARP spoofing, the AINS ignores all the packets so that internet stopping operates. The AINS program needs to be installed only in manager computer that does not require additional agent program. In addition to setting manually the stopping computer list, it is able to indentify network nodes automatically by analyzing broadcasting packets. The experimental results show that less than 4 secs for spoofing interval is enough for blocking internet usage regardless the number of computers and therefore network overhead is negligible. The AINS can indentify and control network nodes not only on same subnet but also on different subnet only if they are connected onto same ethernet switch physically. It is being used for an efficient tool for controling internet usage of university computer laboratory and also for an efficient network management.

참고문헌 (Reference)

1 V. Jacobson, "libpcap, Lawrence Berkeley Laboratory, Berkeley, CA. Initial public release June, 1994"

2 McPherson, D., "VLAN Aggregation for Efficient IP Address Allocation"

3 David C. Plummer, "RFC 826, An Ethernet Address Resolution Protocol. Internet Engineering Task Force, Network Working Group"

4 IETF, "Protocol standard for a NetBIOS service on a TCP/UDP transport: Concept and methods"

5 IpHlpApi Library, "Microsoft Platform SDK"

6 IETF, "Internet Standard Subnetting Procedure"

7 CERTCC-KR, "IP spoofing 공격과 대책, CERTCC-KR 기술문서"

8 Brad Sanford, "IP fragmentation and Fragrouter"

9 Metcalfe, Robert M., "Ethernet: Distributed Packet Switching for Local Computer Networks" 19 (19): 395-405, 1976

10 "Cain & Abel"

11 Sean Whalen, "An Introducation to Arp Spoofing"

12 F. Risso, "An Architecture for High Performance Network Analysis" 686-693, 2001