Project 4-4

Address Resolution Protocol[ARP] is a TCP/IP protocol, it is used to find the hardware address which is also known as the MAC address. ARP determine the MAC address only if the IP or Network address is known. There is one type of protocol which is an mirror image of ARP. That protocol is called Reverse Address Resolution Protocol[RARP], it is used to find the IP address. RARP determine the IP address only if the MAC address is known.

How does ARP poisoning works?

Attackers make use of ARP protocol to alter the MAC address in the ARP cache. Attacker make the router thinks that the attacker computer is a valid computer, by sending malicious ARP reply. Attacker then send another malicious ARP reply to the victim computer, now he makes the victim thinks that he is the actual router. Attacker then make use of the tool "IP forwarding" to forward victim traffic to the actual router.

Attacker can now records the victim information which he/her send over the network. Attacker can also block the victim away from the router, causing a Denial-Of-Service[DOS] to him/her.

Below: Dynamic and Static assigning of ARP cache.

Understanding this practical be done in 2 ways. Go to ARP spoofing to try it out or do it using the virtual machine. Below is the method, where i used virtual machine.

In this practice, i am going to understand the steps in static/dynamic ARP table and knowing the way of how attacker do their ARP poisoning. Before i go on to my practice, i must get more information on my default gateway IP and MAC address.

Commands to remember:

[arp -a] -- This is used to view your current ARP table.
[arp -d] -- This is used to delete the ARP table
[arp -s] -- This is used to manually create a ARP table, also called as static.

How to automatically get ARP table from the default gateway?

Delete of your current ARP table [arp -d gatewayIP]
Ping your default gateway, this will automatically assign your ARP table [ping gatewayIP]
Check if the ARP table have given you back the valid MAC address [arp -a]

How to set your own ARP table?

[arp -s gatwayIP gatewayMAC] -- This will create an ARP table with the IP/MAC you had assign.

*2 words to be noted*

Dynamic - It means Auto-assign.

Static - It means Manuel-assign.

P1062344 posted during Friday, June 4, 2010 at 8:34 AM