Low-and-Slow ARP Flooding: The Bandwidth Attack Your Monitoring Dashboard Will Never Flag

When network engineers picture an ARP-based attack, they typically imagine a dramatic event — packet counts spiking to tens of thousands per second, latency graphs shooting upward, and a monitoring dashboard lighting up with critical alerts. That mental model is precisely what modern attackers are counting on. An increasingly common class of sustained ARP flooding campaigns operates at intensities deliberately calibrated to remain invisible to conventional tooling, consuming bandwidth and degrading performance so gradually that the degradation is often attributed to hardware aging, ISP issues, or seasonal traffic variation before anyone suspects malicious intent.

Understanding why these campaigns succeed — and what it takes to catch them — requires a clear-eyed look at how ARP traffic behaves normally, how monitoring systems are configured to respond to it, and where the structural gaps in detection logic actually lie.

How ARP Request Storms Work at Low Intensity

The Address Resolution Protocol exists to map IP addresses to MAC addresses on a local network segment. Under normal conditions, ARP traffic is bursty and short-lived: a device broadcasts a request, receives a reply, caches the result, and generates minimal additional traffic until the cache entry expires. On a well-managed enterprise LAN, legitimate ARP broadcast rates are predictable and relatively low.

A low-and-slow ARP flood disrupts this baseline in a calculated way. Rather than generating tens of thousands of requests per second — a volume that would immediately saturate monitoring thresholds — an attacker or compromised internal host sends ARP broadcasts at a rate of, say, 200 to 800 packets per second sustained over hours or days. On a moderately sized network segment carrying several gigabits of legitimate traffic, this volume is acoustically quiet. It does not trigger rate-based alerts. It does not cause immediate packet loss. What it does do, over an extended campaign, is consume switch CPU cycles, inflate broadcast domain overhead, exhaust ARP table capacity on resource-constrained devices, and progressively degrade the quality of experience for legitimate users.

The attack surface expands further when an adversary coordinates multiple compromised endpoints across different VLANs, each contributing a sub-threshold ARP broadcast rate that individually registers as unremarkable but collectively represents a meaningful degradation vector.

Why Conventional Monitoring Tools Miss the Pattern

Most network monitoring systems — whether commercial SNMP-based platforms or open-source solutions like Nagios or Zabbix — rely on threshold alerts configured against peak-rate metrics. An administrator sets a threshold: if ARP broadcast packets per second exceed X, generate an alert. This approach is highly effective against burst attacks but is fundamentally blind to gradual accumulation.

The problem is compounded by averaging intervals. Many monitoring platforms sample traffic counters every five minutes and report average rates across that window. A sustained 400-packet-per-second ARP flood, when averaged against legitimate traffic over a five-minute polling interval on a busy segment, may not produce a statistically anomalous data point at all. The signal disappears into the noise.

Additionally, most organizations do not maintain long-term baseline records of ARP traffic by VLAN or segment. Without an established normal range, there is no reference point against which current behavior can be compared. Security teams are, in effect, watching a graph without knowing what the graph should look like.

Intrusion detection systems face a related challenge. Signature-based IDS rules for ARP attacks are typically written to catch known-malicious patterns such as gratuitous ARP flooding or ARP cache poisoning sequences. A low-rate broadcast storm from a single host does not match those signatures. Anomaly-based detection can theoretically identify the drift, but only if the system has been trained on a sufficiently granular and accurate behavioral baseline — a condition that is rarely met in practice.

Documented Organizational Impact

The consequences of undetected sustained ARP flooding have materialized across multiple sectors. In one case examined by network security researchers, a regional healthcare network experienced progressive VoIP quality degradation over approximately six weeks. Helpdesk tickets accumulated around call drops and audio distortion, and the issue was initially escalated to the telephony vendor. A subsequent Layer 2 traffic audit revealed that a single compromised workstation in an administrative VLAN had been generating a consistent 350-packet-per-second ARP broadcast rate for the duration of the complaint period. The workstation had not triggered a single automated alert.

A similar pattern has been documented in higher-education environments, where the density of unmanaged devices on student networks creates a naturally noisy ARP environment. Attackers exploiting this context can sustain significantly higher broadcast rates before the traffic appears anomalous — precisely because the baseline itself is elevated and poorly documented.

In both scenarios, the financial and operational cost of the delay in detection was substantial. Remediation required forensic analysis of switch logs, reconfiguration of broadcast domain boundaries, and in the healthcare case, temporary service disruption during containment.

Practical Detection Strategies for Security Teams

Addressing this class of attack requires a shift from reactive threshold alerting toward proactive baseline monitoring and behavioral analysis. The following strategies can be implemented with tools and infrastructure that most US enterprise environments already possess.

Establish per-VLAN ARP traffic baselines. Using NetFlow, sFlow, or dedicated packet capture infrastructure, collect ARP broadcast rate data by VLAN over a representative two-to-four-week period during normal operations. Document mean rates, standard deviations, and peak patterns by time of day and day of week. This baseline becomes the reference against which future traffic is evaluated.

Implement source-level ARP rate monitoring on managed switches. Most enterprise-grade switches from major vendors support Dynamic ARP Inspection (DAI) and ARP rate limiting per port. Configuring per-port ARP rate limits not only constrains flooding but generates log events when limits are approached, providing early-warning telemetry that can feed into a SIEM.

Deploy extended trending analysis in your SIEM. Configure your security information and event management platform to trend ARP broadcast rates over rolling 24-hour and 7-day windows, not just instantaneous snapshots. A host whose ARP output increases by 15 percent week over week may not trigger a point-in-time alert but will be visible as a drift anomaly in a properly configured trend rule.

Audit ARP table sizes on routers and Layer 3 switches regularly. ARP table exhaustion is a measurable consequence of sustained flooding. Automated polling of ARP table utilization against device capacity limits can surface flooding campaigns that have not yet been detected through traffic analysis alone.

Cross-reference ARP anomalies with endpoint behavior logs. A workstation generating anomalous ARP traffic should also show corresponding process or network activity in endpoint detection and response telemetry. Correlating these data sources reduces false positives and accelerates investigation.

Building the Institutional Knowledge to Stay Ahead

The gap between what these attacks exploit and what most monitoring configurations catch is, at its core, a knowledge gap. Network security professionals who understand ARP at the protocol level — who can reason about broadcast domain behavior, ARP cache mechanics, and Layer 2 traffic patterns from first principles — are substantially better positioned to design detection architectures that account for low-and-slow techniques.

This is precisely the kind of foundational protocol expertise that ARP Certificate's credentialing framework is designed to develop. Recognizing the mechanics of an ARP request storm is not an advanced specialization reserved for seasoned researchers; it is a baseline competency for any security professional responsible for defending a modern enterprise network. The organizations that have suffered extended, undetected ARP flooding campaigns share a common characteristic: their monitoring architectures were designed by professionals who understood thresholds but not traffic behavior at the protocol level.

Investing in that deeper understanding is not optional. It is the prerequisite for building detection systems that actually work.