AXARPS: Scalable ARP Snooping Using Policy-Based Mirroring of Core Switches

Abstract

In order to handle a computer security incident or network failure, it is important to grasp a list of pairs of IP and MAC addresses of hosts. Ones may then traditionally poll an Address Resolution Protocol (ARP) table of a core switch at an interval using SNMP or other methods. This traditional method based upon polling, however, has two major drawbacks that (1) some pairs of IP and MAC addresses may not be obtained and (2) incurs a heavy load on a core switch. This paper then proposes AXARPS that is the novel scalable ARP snooping to build a list of pairs of IP and MAC addresses. AXARPS can avoid missing pairs of IP and MAC addresses by monitoring all ARP traffic instead of the traditional method. AXARPS also can reduce a CPU load on a recent high-end core switch by approximately 20% in comparison with the traditional method. AXARPS is scalable because AXARPS incurs no additional CPU load even the number of hosts increases. AXARPS employs a policy-based mirroring of a switch that mirror traffic that matches a specified filter. The policy-based mirroring can then mirror ARP traffic only, and reduce a load on an ARP parsing server.