An AARP spoof is performed.
Replying to an ARP request before the real owner of the IP address.
Because of the lack of authentication mechanisms in our protocol, you're able to set yourself as the
owner of the IP in the source machines ARP table.
Okay to understand the ARP spoof or ARP cache poisoning attack.
Let's remember the ARP protocol and its principles once again.
Address resolution protocol.
ARP is a network layer protocol used for mapping a network address, such as an IPV four address to
a physical address such as a mac address.
To simulate how the AARP mechanism works.
We have a small network in the slide, a switch on top, and three computers connected to it.
Computer A wants to talk to Computer C.
It puts an ARP request onto the wire, which happens to be broadcast.
Essentially what it's saying is who has computer sees Mac address.
Of course, because it's a broadcast, every system on the network hears it.
Does everybody respond?
Well, what happens is that B hears it.
A is looking for the Mac address of Computer C.
Be knows that it's not computer see, and therefore does not respond to the broadcast.
The broadcast.
The request goes out to every system, but the only system that will reply is computer C with an ARP
reply.
In other words, Computer A says who has the Mac address of Computer C?
And although all the workstations here, the question only C replies and says, I've got the Mac address
of Computer C and this is what it is.
So the ARP reply sends back the Mac address to Computer A and each of these machines start building
an ARP table.
These are how ARP requests and responses look in Wireshark.
The first packet is an ARP request.
As you see, it is broadcast and the second packet is an ARP reply.
The owner of the IP 2007 answers with its Mac address.
As you see, ARP request is broadcast throughout the network and the first reply is trusted and accepted.
Okay.
So we have already seen the routine of the ARP protocol.
Computer A sends an ARP request.
The request is broadcast.
The owner of the IP replies with an ARP reply, and both sides update their ARP tables.
Now we have an attacker in the network.
Okay, so this is how the Arpspoof attack works.
Computer A wants to talk to Computer C if the Mac address table of computer C is not in the ARP table
of Computer A, it puts an ARP request into the wire which happens to be broadcast.
This is a point where all the computers on the network get the ARP request.
So although it's not his IP address, the attacker replies the ARP request before the real owner.
In this reply, the attacker puts his own Mac address corresponding to the target IP address.
Computer A receives the ARP reply and stores the address pair in its ARP table and communication takes
place.