Detecting MAC/IP spoofing attacks on networks

A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing component, the machine-readable storage medium comprising instructions to cause the hardware processor to perform a method comprising:

• authenticating a network device for access to a network using a Media Access Control (MAC) address and an Internet Protocol (IP) address of the network device;
• wherein an attacking device is connected to the network, and to the network device, by a network hub;
• wherein the attacking device spoofs the MAC address and the IP address of the network device;
• establishing a Transport Control Protocol (TCP) connection with the network device subsequent to authenticating the network device;
• sending at least one TCP keepalive message to the IP address of the network device, wherein, responsive to receiving the TCP keepalive message, the attacking device transmits a TCP reset (RST) message;
• receiving the TCP RST message;
• and
• determining the attacking device is present in the network responsive to receiving the TCP RST message.

A method comprising:

• authenticating a network device for access to a network using a Media Access Control (MAC) address and an Internet Protocol (IP) address of the network device;
• wherein an attacking device is connected to the network, and to the network device, by a network hub;
• wherein the attacking device spoofs the MAC address and the IP address of the network device;
• establishing a Transport Control Protocol (TCP) connection with the network device subsequent to authenticating the network device;
• sending at least one TCP keepalive message to the IP address of the network device, wherein, responsive to receiving the TCP keepalive message, the attacking device transmits a TCP reset (RST) message;
• receiving the TCP RST message;
• and
• determining the attacking device is present in the network responsive to receiving the TCP RST message.