ARP

While essential for normal network communication, ARP is also vulnerable to exploitation through attacks like ARP spoofing, where an attacker sends forged ARP messages to associate their MAC address with the IP address of a legitimate device. This can enable man-in-the-middle attacks, traffic interception, or network disruption.

ARP in Nzyme

ARP is used to enrich asset inventory data. Additionally, all recorded ARP traffic can be inspected and analyzed under the ARP tab on the Assets page.

Configuration

The most important ARP configuration takes place in your Nzyme tap configuration files:

[protocols.arp]
pipeline_size = 1024
poisoning_monitor = true
poisoning_window_seconds = 30

Variable	Description
pipeline_size	The tap process moves data internally using in-memory pipelines. You may have to increase this value if you experience high throughput of ARP segments.
poisoning_monitor	Enable detection of ARP poisoning?
poisoning_window_seconds	Time window a MAC address cannot have multiple IP addresses in or it will be considered poisoned.