高校如何防止ARP欺骗攻击？

Question

I stay in a college hostel and in our campus wifi network someone is ARP spoofing. What can be possible improvement done to existing network architecture to prevent someone doing such types of attack?

Answer 1

To help prevent ARP poisoning enterprise switches provide enhanced security firmware eg - http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/white_paper_c11_603839.html

Dynamic ARP Inspection (DAI) is a security feature that is available on Cisco Catalyst 6500 Series switches running Cisco IOS Software or Cisco Catalyst OS. Dynamic ARP inspection helps prevent ARP poisoning and other ARP-based attacks by intercepting all ARP (Address Resolution Protocol) requests and responses, and by verifying their authenticity before updating the switch's local ARP cache or forwarding the packets to the intended destinations. Note that on Cisco Catalyst 6500 Series switches, Dynamic ARP requires Supervisor 2, Supervisor 32, or Supervisor 720. As previously stated, a Supervisor 720-3B was used in these tests....

**** A possible remedy for end users might be ****

As an end user you can somewhat defend against this attack by preventing your machine from accepting ARP requests from other machines on your local network. The blog below has some very useful tips to defend your own machine. I cant vouch for using netcut to prevent ARP poisoning but ESET is a popular commercial anti-virus so i would imagine it's a safe bet.

https://www.raymond.cc/blog/protect-your-computer-against-arp-poison-attack-netcut/