Real-Time Detection And Mitigation Of Address Resolution Protocol Spoofing In Software-Defined Networks Using A POX Controller Module
TL;DR
This study develops and evaluates a POX-controller module that detects and mitigates ARP spoofing in real time without modifying the data plane and suggests a practical security control for campus and edge SDN environments where rapid containment and auditable operation are required.
Abstract
Software-Defined Networking (SDN) simplifies network control by centralizing decisions in a controller, yet many deployments still depend on legacy Layer-2 behavior that was not designed for adversarial settings. Address Resolution Protocol (ARP) spoofing illustrates this weakness, because forged IP to MAC mappings can quietly redirect traffic and enable man-in-the-middle interception. This study develops and evaluates a POX-controller module that detects and mitigates ARP spoofing in real time without modifying the data plane. The module maintains an adaptive IP to MAC binding table and validates ARP packets, with particular attention to ARP replies that attempt to update bindings. Conflicting updates are blocked and recorded as structured events to support traceability. Experiments on a Mininet test-bed indicate that the module preserves ARP-cache correctness under sustained attacks while keeping packet loss low and controller overhead modest in the tested scenarios. These findings suggest a practical security control for campus and edge SDN environments where rapid containment and auditable operation are required.