splunk_escuTTP

Detect ARP Poisoning

The following analytic detects ARP Poisoning attacks by monitoring for Dynamic ARP Inspection (DAI) errors on Cisco network devices. It leverages logs from Cisco devices, specifically looking for events where the ARP inspection feature has disabled an interface due to suspicious activity. This activity is significant because ARP Poisoning can allow attackers to intercept, modify, or disrupt network traffic, leading to potential data breaches or denial of service. If confirmed malicious, this could enable attackers to perform man-in-the-middle attacks, compromising the integrity and confidentiality of network communications.

MITRE ATT&CK

T1200 T1498 T1557.002

Detection Query

`cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection"
  | eval src_interface=src_int_prefix_long+src_int_suffix
  | stats min(_time) AS firstTime max(_time) AS lastTime count
    BY host src_interface
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `detect_arp_poisoning_filter`

Author

Mikael Bjerkeland, Splunk

Created

2026-03-10

Data Sources

Cisco IOS Logs

Tags

Router and Infrastructure Security

Raw Content

name: Detect ARP Poisoning
id: b44bebd6-bd39-467b-9321-73971bcd1aac
version: 10
date: '2026-03-10'
author: Mikael Bjerkeland, Splunk
status: experimental
type: TTP
description: The following analytic detects ARP Poisoning attacks by monitoring for Dynamic ARP Inspection (DAI) errors on Cisco network devices. It leverages logs from Cisco devices, specifically looking for events where the ARP inspection feature has disabled an interface due to suspicious activity. This activity is significant because ARP Poisoning can allow attackers to intercept, modify, or disrupt network traffic, leading to potential data breaches or denial of service. If confirmed malicious, this could enable attackers to perform man-in-the-middle attacks, compromising the integrity and confidentiality of network communications.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection"
      | eval src_interface=src_int_prefix_long+src_int_suffix
      | stats min(_time) AS firstTime max(_time) AS lastTime count
        BY host src_interface
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `detect_arp_poisoning_filter`
how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and Dynamic ARP Inspection (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_01111.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
known_false_positives: This search might be prone to high false positives if DHCP Snooping or ARP inspection has been incorrectly configured, or if a device normally sends many ARP packets (unlikely).
references: []
rba:
    message: Potential ARP poisoning detected on $host$
    risk_objects:
        - field: host
          type: system
          score: 50
    threat_objects: []
tags:
    analytic_story:
        - Router and Infrastructure Security
    asset_type: Infrastructure
    mitre_attack_id:
        - T1200
        - T1498
        - T1557.002
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: network