In this lesson, we're going to discuss
Address Resolution Protocol attacks.
Now, Address Resolution Protocol, or ARP,
is a fundamental concept in IP networking
that's used to map an IP address to a MAC address
on a given local area network.
Unfortunately, ARP is a really old protocol,
and it doesn't have a lot of security built into it,
so, it's vulnerable to attacks such as ARP spoofing,
and ARP poisoning.
First, let's consider ARP spoofing.
Now, ARP spoofing is an attack where an attacker
is going to send falsified ARP messages
over the local area network.
This can result in linking the attacker's MAC address
with the IP address of a legitimate computer
or server that's already on that network.
Now, the goal here for the attacker
is to get the attacker's MAC address
to become associated with an IP address
for legitimate service.
This will then allow the attacker
to begin receiving any data that was meant
for that legitimate IP address,
and this allows them to intercept, modify,
or even stop data in transit if they want to.
In fact, this kind of ARP spoofing can be used
to initiate an on-path attack inside
of your layer 2 networks.
Second, we have ARP poisoning.
Now, ARP poisoning is a form of attack
that corrupts the ARP cache in the network,
which is also known as your ARP table.
The ARP poisoning involves sending malicious ARP packets
to a default gateway on a LAN
to try to associate the attacker's MAC address
with the IP address of each LAN device.
By using ARP poisoning, an attacker can alter
the network traffic flow and enable data interception,
session hijacking, or denial of service attacks.
Now, I know these sound very similar,
so, let me highlight the difference between ARP spoofing
and ARP poisoning for you.
In an ARP spoofing attack, the attacker is aiming
to conduct a more targeted attack
so that their machine replaces a legitimate network host
inside the ARP cache or ARP table,
but in an ARP poisoning attack,
the attacker's attempting to send malicious ARP messages
to the network's default gateway
so that their own MAC address will be associated
with multiple IP addresses for any
or all of the devices inside of that LAN.
So, an ARP spoof goes after a single host traffic,
whereas poisoning is really a larger scale version of this,
where they're trying to affect most
or all of the hosts on a given LAN.
Now, attackers like to attempt ARP attacks,
because it allows them to intercept their data,
conduct on-path attacks, and cause network disruptions.
Data interception can occur if the attacker's MAC address
can become associated with a legitimate IP address,
and that way, any sensitive data that's destined
for that legitimate IP address will be intercepted,
and then altered before reaching its intended destination.
ARP spoofing is often used as a precursor
for on-path attacks, too,
where the attacker can intercept and modify communication
between two parties without their knowledge.
Additionally, the use of ARP poisoning can lead
to significant network disruptions,
and this makes it a good option in conducting
denial of service attacks on a local area network.
In order to perform an ARP attack,
the attacker will first scan the network
to capture IP addresses and MAC addresses
that are linked together in pairs.
Using a specialized software tool,
the attacker can then send out fake ARP responses.
These responses will try to convince devices on the network
that the attacker's MAC address actually corresponds
to a legitimate IP address,
which is often going to be using the gateway IP.
Another common technique is to conduct
an ARP poisoning attack by conducting an ARP flood
on the network with malicious ARP packets
that are used to associate the attacker's MAC address
with the IP addresses of other devices on that network.
By using either of these techniques,
the ARP cache can be corrupted,
because the devices on the network will be storing
the malicious MAC-IP address mappings
in their own ARP caches,
and this will then cause them to send traffic
to the attacker instead of the real host
or legitimate IP address.
To detect ARP attacks, you need to use ARP monitoring tools
to monitor ARP address mappings,
and then alert your network administrators
of any unusual ARP traffic patterns
that might suggest possible ARP spoofing is occurring.
Also, you can configure your Intrusion Detection Systems,
or IDSs, to detect anomalies and traffic patterns,
and to potentially identify ARP spoofing
or poisoning activities on your networks.
To help prevent ARP spoofing and ARP poisoning,
you can use static ARP entries, dynamic ARP inspection,
network segmentation, and VPNs, or encryption technologies.
First, we have static ARP entries.
By manually entering static ARP entries into your devices,
you'll be able to prevent ARP spoofing.
Unfortunately, though, this technique only works well
in smaller networks,
because it becomes impractical for large or dynamic networks
'cause of all the overhead that would be involved
in setting this up statically.
Second, you can turn on Dynamic ARP Inspection.
Dynamic ARP Inspection, or DAI,
is a feature on most modern switches
that can be used to inspect the ARP packets in the network
and compare them against a trusted database
of MAC-IP pairings.
If any untrusted or suspicious mappings are found,
the corresponding ARP packets will be dropped
as they try to pass through the DAI-capable switch.
Third, we have network segmentation.
By dividing up our network into smaller segments
by using things like VLANs,
we can limit the scope of an ARP attack
and make our network management much more straightforward.
Fourth and finally, we have the use of VPNs
and encryption technologies.
By using VPNs and encrypting your data,
you're going to be able to prevent attackers
from reading or modifying intercepted data,
even if their ARP spoofing attacks were successful.
So remember, ARP spoofing and poisoning
are significant security threats in network environments.
They're designed to take advantage
of the inherent vulnerabilities of the ARP protocol.
ARP spoofing is an attack where an attacker
is going to send falsified ARP messages
over your local area network to result
in the linking of an attacker's MAC address
with the IP address of a legitimate computer
or server on that network.
ARP poisoning is a form of attack
that corrupts the ARP cache or the ARP table,
and ARP poisoning involves sending malicious ARP packets
to a default gateway on the LAN
to associate the attacker's MAC address
with the IP address of each LAN device.
To prevent ARP spoofing and ARP poisoning from occurring,
you should implement vigilant monitoring,
employ preventative technologies,
like Dynamic ARP Inspection,
and adhere to network security best practices
to significantly mitigate the risks associated
with ARP attacks.