Detection rules › Splunk
Detect ARP Poisoning
The following analytic detects ARP Poisoning attacks by monitoring for Dynamic ARP Inspection (DAI) errors on Cisco network devices. It leverages logs from Cisco devices, specifically looking for events where the ARP inspection feature has disabled an interface due to suspicious activity. This activity is significant because ARP Poisoning can allow attackers to intercept, modify, or disrupt network traffic, leading to potential data breaches or denial of service. If confirmed malicious, this could enable attackers to perform man-in-the-middle attacks, compromising the integrity and confidentiality of network communications.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1200 Hardware Additions |
| Credential Access | T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning |
| Collection | T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning |
| Impact | T1498 Network Denial of Service |
Rule body splunk
name: Detect ARP Poisoning
id: b44bebd6-bd39-467b-9321-73971bcd1aac
version: 11
creation_date: '2020-08-11'
modification_date: '2026-05-13'
author: Mikael Bjerkeland, Splunk
status: experimental
type: TTP
description: The following analytic detects ARP Poisoning attacks by monitoring for Dynamic ARP Inspection (DAI) errors on Cisco network devices. It leverages logs from Cisco devices, specifically looking for events where the ARP inspection feature has disabled an interface due to suspicious activity. This activity is significant because ARP Poisoning can allow attackers to intercept, modify, or disrupt network traffic, leading to potential data breaches or denial of service. If confirmed malicious, this could enable attackers to perform man-in-the-middle attacks, compromising the integrity and confidentiality of network communications.
data_source:
- Cisco IOS Logs
search: |-
`cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection"
| eval src_interface=src_int_prefix_long+src_int_suffix
| stats min(_time) AS firstTime max(_time) AS lastTime count
BY host src_interface
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `detect_arp_poisoning_filter`
how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and Dynamic ARP Inspection (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_01111.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
known_false_positives: This search might be prone to high false positives if DHCP Snooping or ARP inspection has been incorrectly configured, or if a device normally sends many ARP packets (unlikely).
references: []
finding:
title: Potential ARP poisoning detected on $host$
entity:
field: host
type: system
score: 50
analytic_story:
- Router and Infrastructure Security
asset_type: Infrastructure
mitre_attack_id:
- T1200
- T1498
- T1557.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: network
security_domain: network
Stages and Predicates
Stage 1: search
`cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection"
Stage 2: eval
| eval src_interface=src_int_prefix_long+src_int_suffix
Stage 3: stats
| stats min(_time) AS firstTime max(_time) AS lastTime count
BY host src_interface
Stage 4: search
| `security_content_ctime(firstTime)`
Stage 5: search
| `security_content_ctime(lastTime)`
Stage 6: search
| `detect_arp_poisoning_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
disable_cause | eq |
|
facility | eq |
|
mnemonic | eq |
|