ARP protocol attacks and defenses
Camouflage and Skullduggery
© Lead Image © Andre Zhak, 123RF.com
ARP spoofing can be used to initiate denial-of-service attacks, network hijacking, and man-in-the-middle attacks on the Intranet. We look at how to prevent these incursions.
Companies spend huge amounts of money to protect themselves from attacks on the Internet, but the security of the intranet it is not very advanced in most small to medium-sized enterprises. The credo is often: Internal users will not attack their own. The reality is rather different, which is reason enough to take a look at one of the most common attacks and defense options on internal networks: ARP Spoofing.
On the intranet, unlike the Internet, addressing is not based on Layer 3 (IP), but on Layer 2 (Ethernet). A packet identifies its target by reference to the MAC address. To ensure that resolution between IPv4 addresses and MAC addresses runs smoothly, ARP (Address Resolution Protocol) or its counterpart RARP (reverse ARP) are used.
If computer A wants to communicate with computer B, A sends an ARP request to the broadcast address to discover the MAC address of B. Computer B responds with an ARP reply. In a TCP dump, this kind of conversation looks like Listing 1.
[...]
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
US / Canada
UK / Australia