An AARP spoof is performed replying to an AAP request before the real owner of the IP address.
Because of the lack of authentication mechanisms in our protocol, you're able to set yourself as the
owner of the IP in the source machine's ARP table.
OK, do you understand the art spoof or AAP cash poisoning attack?
Let's remember the art protocol and its principles once again.
Address Resolution Protocol AAFP is a network layer protocol used for mapping a network address such
as an IP v4 address to a physical address such as a Mac address.
To simulate how the ERP mechanism works, we have a small network in the slide, a switch on top and
three computers connected to it.
Computer wants to talk to computers, see?
It puts an ARP request onto the wire, which happens to be broadcast, essentially what it's saying
is who has computers, his Mac address.
Of course, because it's a broadcast, every system on the network hears it.
Does everybody respond well, what happens is that B hears that A is looking for the Mac address of
Computer C.
B knows that it's not computer C and therefore does not respond to the broadcast.
The broadcast, the request goes out to every system, but the only system that will reply is computer
see with an ARP reply.
In other words, Computer says, who has the Mac address of a computer see, and although all the workstations
here, the question only she replies and says, I've got the Mac address of computer C and this is what
it is.
So they are purply sends back the Mac address, the computer A and each of these machines start building
an ark table.
These are how our request and responses look in Wireshark, the first packet is in our request.
As you see it is broadcast and the second packet is in our reply, the owner of the IP two zero seven
answers with its Mac address.
As you see, our request is broadcast throughout the network and the first reply is trusted and accepted.
OK, so we have already seen the routine of the AAFP protocol.
A computer sends an AAP request, the request is broadcast.
The owner of the AIP replies with an ARP reply and both sides update, there are tables.
Now we have an attacker in the network.
OK, so this is how the art spoof attack works, computer AI wants to talk to computer, see if the
Mac address table of computers C is not in the art table of computer.
It puts an ARP request into the wire, which happens to be broadcast.
This is a point where all the computers on the network get the ARP request.
So although it's not his IP address, the attacker replies the AAP request before the real owner.
In this hour, Purply, the attacker, puts his own Mac address corresponding to the Target IP address.
Computer receives the art supply and stores the address paper and its art table and communication takes
place.