Scribd Logo
Upload

Welcome to Scribd!

  • 218 views

    Address Resolution Protocol (ARP) : Relates To Lab 2

    Uploaded by

    Abdul Wahab Ali
    The document discusses the Address Resolution Protocol (ARP) which relates IP addresses to MAC addresses. It provides an overview of ARP and the Reverse Address Resolution Protocol (RARP). It describes how ARP works, including ARP requests, replies, and caches. It notes vulnerabilities in ARP that can allow forged ARP packets to redirect traffic.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd

    Address Resolution Protocol (ARP) : Relates To Lab 2

    Uploaded by

    Abdul Wahab Ali
    218 views12 pages
    The document discusses the Address Resolution Protocol (ARP) which relates IP addresses to MAC addresses. It provides an overview of ARP and the Reverse Address Resolution Protocol (RARP). It describes how ARP works, including ARP requests, replies, and caches. It notes vulnerabilities in ARP that can allow forged ARP packets to redirect traffic.

    Original Title

    module06-arpV2

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses the Address Resolution Protocol (ARP) which relates IP addresses to MAC addresses. It provides an overview of ARP and the Reverse Address Resolution Protocol (RARP). It describes how ARP works, including ARP requests, replies, and caches. It notes vulnerabilities in ARP that can allow forged ARP packets to redirect traffic.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    218 views12 pages

    Address Resolution Protocol (ARP) : Relates To Lab 2

    Uploaded by

    Abdul Wahab Ali
    The document discusses the Address Resolution Protocol (ARP) which relates IP addresses to MAC addresses. It provides an overview of ARP and the Reverse Address Resolution Protocol (RARP). It describes how ARP works, including ARP requests, replies, and caches. It notes vulnerabilities in ARP that can allow forged ARP packets to redirect traffic.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    You are on page 1of 12

    Address Resolution Protocol (ARP)

    Relates to Lab 2. This module is about the address resolution protocol.

    Overview

    TCP

    UDP

    Transport Layer

    ICMP

    IP

    IGMP

    Network Layer

    ARP

    Network Access

    RARP

    Link Layer

    Media

    ARP and RARP


    Note: The Internet is based on IP addresses Data link protocols (Ethernet, FDDI, ATM) may have different (MAC) addresses The ARP and RARP protocols perform the translation between IP addresses and MAC layer addresses We will discuss ARP for broadcast LANs, particularly Ethernet LANs
    IP address (32 bit)

    ARP RARP

    Ethernet MAC address (48 bit)


    3

    Processing of IP packets by network device drivers

    IP Output

    IP Input

    Put on IP input queue


    Yes

    Yes

    IP destination = multicast or broadcast ?


    No

    Put on IP input queue

    IP destination of packet = local IP address ?

    Ethernet Driver
    ARP Packet

    IP datagram

    loopback Driver

    No: get MAC address with ARP Ethernet

    ARP

    demultiplex Ethernet Frame

    Address Translation with ARP


    ARP Request: Argon broadcasts an ARP request to all stations on the network: What is the hardware address of Router137?
    Argon 128.143.137.144 00:a0:24:71:e4:44
    ARP Request: What is the MAC address of 128.143.71.1?

    Router137 128.143.137.1 00:e0:f9:23:a8:20

    Address Translation with ARP


    ARP Reply: Router 137 responds with an ARP Reply which contains the hardware address
    Argon 128.143.137.144 00:a0:24:71:e4:44
    ARP Reply: The MAC address of 128.143.71.1 is 00:e0:f9:23:a8:20

    Router137 128.143.137.1 00:e0:f9:23:a8:20

    ARP Packet Format


    Ethernet II header Destination address 6 Source address 6 Type 0x8060 2

    ARP Request or ARP Reply


    28

    Padding 10

    CRC 4

    Hardware type (2 bytes) Hardware address length (1 byte) Protocol address length (1 byte)

    Protocol type (2 bytes) Operation code (2 bytes)

    Source hardware address* Source protocol address* Target hardware address* Target protocol address* * Note: The length of the address fields is determined by the corresponding address length fields
    7

    Example
    ARP Request from Argon: Source hardware address: Source protocol address: Target hardware address: Target protocol address: ARP Reply from Router137: Source hardware address: Source protocol address: Target hardware address: Target protocol address:

    00:a0:24:71:e4:44 128.143.137.144 00:00:00:00:00:00 128.143.137.1

    00:e0:f9:23:a8:20 128.143.137.1 00:a0:24:71:e4:44 128.143.137.144

    ARP Cache
    Since sending an ARP request/reply for each IP datagram is inefficient, hosts maintain a cache (ARP Cache) of current entries. The entries expire after 20 minutes. Contents of the ARP Cache:
    (128.143.71.37) at 00:10:4B:C5:D1:15 [ether] on eth0 (128.143.71.36) at 00:B0:D0:E1:17:D5 [ether] on eth0 (128.143.71.35) at 00:B0:D0:DE:70:E6 [ether] on eth0 (128.143.136.90) at 00:05:3C:06:27:35 [ether] on eth1 (128.143.71.34) at 00:B0:D0:E1:17:DB [ether] on eth0 (128.143.71.33) at 00:B0:D0:E1:17:DF [ether] on eth0

    Proxy ARP
    Proxy ARP: Host or router responds to ARP Request that arrives from one of its connected networks for a host that is on another of its connected networks.

    10

    Things to know about ARP


    What happens if an ARP Request is made for a non-existing host? Several ARP requests are made with increasing time intervals between requests. Eventually, ARP gives up. On some systems (including Linux) a host periodically sends ARP Requests for all addresses listed in the ARP cache. This refreshes the ARP cache content, but also introduces traffic. Gratuitous ARP Requests: A host sends an ARP request for its own IP address: Useful for detecting if an IP address has already been assigned.
    11

    Vulnerabilities of ARP
    1. Since ARP does not authenticate requests or replies, ARP Requests and Replies can be forged 2. ARP is stateless: ARP Replies can be sent without a corresponding ARP Request 3. According to the ARP protocol specification, a node receiving an ARP packet (Request or Reply) must update its local ARP cache with the information in the source fields, if the receiving node already has an entry for the IP address of the source in its ARP cache. (This applies for ARP Request packets and for ARP Reply packets) Typical exploitation of these vulnerabilities: A forged ARP Request or Reply can be used to update the ARP cache of a remote system with a forged entry (ARP Poisoning) This can be used to redirect IP traffic to other hosts
    12

    You might also like