Arp Spoofing in Chi with Cockroachdb

Arp Spoofing is a Layer 2 attack where an attacker sends falsified ARP messages to associate their MAC address with the IP of a legitimate host, such as a Cockroachdb node in a Chi cluster. In a Chi deployment that uses Cockroachdb for distributed SQL storage, nodes typically communicate over specific internal IP ranges. If an attacker joins the same network segment and runs an Arp Spoofing campaign, they can intercept or redirect traffic between Chi application nodes and Cockroachdb nodes.

Because Chi services often rely on stable, low-latency database connections, the spoofed ARP responses can cause Chi routing logic to mistakenly send queries to the attacker’s machine rather than the intended Cockroachdb node. This becomes especially risky when Cockroachdb does not enforce strict mTLS between nodes or when internal network segmentation is weak. An attacker who successfully intercepts traffic may observe unencrypted metadata, session tokens, or even query parameters that traverse the network in clear text, depending on the TLS configuration of Cockroachdb.

The risk is compounded when Chi services use service discovery mechanisms that rely on IP-to-node mappings without additional integrity checks. An attacker can exploit this by continuously sending spoofed replies so that the ARP cache on Chi nodes remains poisoned for the duration of the attack window. Because Cockroachdb nodes communicate via gossip protocols, a poisoned ARP cache can disrupt cluster consensus, cause leader re-election storms, or create split-brain scenarios that degrade availability.

middleBrick can detect such risks by scanning the unauthenticated attack surface of exposed Chi endpoints and associated Cockroachdb management interfaces. While it does not fix the network configuration, its findings include specific remediation guidance to harden the environment against Layer 2 attacks.

To mitigate Arp Spoofing in a Chi + Cockroachdb setup, enforce encrypted and authenticated communication, and reduce reliance on implicit trust at the network layer. Below are targeted remediation steps with realistic code examples that you can apply in Chi configurations and Cockroachdb connection strings.

1. Enforce TLS for all Cockroachdb connections

Ensure that every Chi service connects to Cockroachdb using secure connections with certificate verification. This prevents passive sniffing and tampering even if ARP is poisoned.

cockroach sql --certs-dir=certs --host=cockroachdb.internal --port=26257 --database=mydb --user=root

In your Chi application configuration, pass TLS settings explicitly:

database:
  connection:
    host: cockroachdb-internal
    port: 26257
    sslmode: verify-full
    sslrootcert: /etc/certs/ca.crt
    sslcert: /etc/certs/client.crt
    sslkey: /etc/certs/client.key

2. Use node-specific host entries or Kubernetes headless services

In a Chi deployment, map Cockroachdb node hostnames to specific IPs via StatefulSet headless services or static hosts to reduce reliance on dynamic ARP resolution.

apiVersion: v1
kind: Service
metadata:
  name: cockroachdb
  clusterIP: None
spec:
  ports:
  - port: 26257
    name: grpc
  - port: 8080
    name: http
  selector:
    app: cockroachdb
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cockroachdb
spec:
  serviceName: cockroachdb
  replicas: 3
  template:
    metadata:
      labels:
        app: cockroachdb
    spec:
      containers:
      - name: cockroachdb
        image: cockroachdb/cockroach:v23.1
        command:
        - cockroach
        - start
        - --certs-dir=/cockroach/cockroach-certs
        - --advertise-addr=$(POD_NAME).cockroachdb.default.svc.cluster.local
        - --join=cockroachdb-0.cockroachdb.default.svc.cluster.local,cockroachdb-1.cockroachdb.default.svc.cluster.local,cockroachdb-2.cockroachdb.default.svc.cluster.local
        ports:
        - containerPort: 26257
          name: grpc
        - containerPort: 8080
          name: http

3. Enable experimental ARP protection on node OS

While not a Chi-specific configuration, hardening the underlying OS reduces the success rate of Arp Spoofing. On each Cockroachdb host, enable strict ARP filtering:

# sysctl -w net.ipv4.conf.all.arp_ignore=1
# sysctl -w net.ipv4.conf.all.arp_announce=2

4. Monitor internal traffic anomalies

Use runtime detection mechanisms to identify sudden changes in MAC-IP bindings across the Chi network. Though middleBrick does not block or fix, its scan findings can guide where to place additional observability for suspicious ARP replies targeting Cockroachdb interfaces.