Can Suricata IPS detect and prevent ARP poisoning attacks?

Question

Does Suricata IPS have the capability to detect and prevent ARP poisoning attacks? Snort uses a preprocessor that decodes ARP packets and detects ARP attacks, but I couldn't find any such capability mentioned for Suricata IPS.

Answer 1

Arp attacks related to layer 2 of OSI model. Suricata and Snort IDPS is developed to detect attacks at the higher level of OSI model. Suricata doesn't have mechanism to detect such type attacks. Snort has a preprocessor to detect arp attacks but that needs some configuration. I have worked on that and I didn't found it useful because sometimes it will not work. The main drawback of snort arpspoof preprocessor is you have to manually specify the ip and hardware address to arpspoof-detect-host. The host and snort should be in the same layer 2 segment. To prevent such types of attacks the best solution is to use layer 2 device Switch.