Year: 2026
Type: article
Abstract: This report examines the security of the Data Link Layer (Layer 2) of the OSI model, focusing on fundamental vulnerabilities in core local communication protocols. It addresses the concept of "implicit trust" inherent in the design of the Address Resolution Protocol (ARP) and the Domain Name System (DNS), which enables Man-in-the-Middle (MITM) attacks. The report analyzes the theoretical mechanisms of ARP cache poisoning and DNS spoofing. Network traffic was intercepted and subjected to forensic analysis through controlled simulations in an isolated laboratory environment. Key packet-level Indicators of Compromise (IoCs) were identified, including duplicate MAC addresses, an anomalous frequency of unsolicited ARP responses (Gratuitous ARP), and unusually low DNS resolution response times. In conclusion, architectural and software-based protective measures are outlined, including the implementation of Dynamic ARP Inspection (DAI), Port Security, and encrypted DNS protocols (DoH/DoT).
Authors: Denis Zvezdelinov, Zdravko Kuzmanov
Institution: Shumen University
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7225389682