User-side detection and containment of arp spoofing attacks

An apparatus, comprising

• a memory;
• and
• a processor coupled to the memory, the processor to:
• detect an incorrect first address to second address mapping in an Address Resolution Protocol (ARP) cache of one or more of:
• a user device or a gateway device;
• and
• perform one or more containment operations, wherein the containment operations comprise one or more of:
• transmitting an ARP request message that requests an Internet Protocol (IP) address to Media Access Control (MAC) address mapping for a gateway device onto a subnetwork, transmitting an ARP message that comprises an IP address to MAC address mapping for a user device onto the subnetwork, or alerting a user.

A non-transitory computer-readable medium comprising code which, when executed by a processor, causes the processor to perform a method, the method comprising:

• detecting an incorrect first address to second address mapping in an Address Resolution Protocol (ARP) cache of one or more of:
• a user device or a gateway device;
• and
• performing one or more containment operations, wherein the containment operations comprise one or more of:
• transmitting an ARP request message that requests an Internet Protocol (IP) address to Media Access Control (MAC) address mapping for a gateway device onto a subnetwork, transmitting an ARP message that comprises an IP address to MAC address mapping for a user device onto the subnetwork, or alerting a user.