Let's now consider the next layer the data link layer is layer to this layer is susceptible to Mac spoofing.
The second layer of the OSA model includes the Internet protocol is used in most local networks no matter
whether it's a wired or wireless network.
The Internet Protocol is widely employed.
And Internet networks the sender hosts identity and the receiver whose identity is determined by the
MAC address often called the physical address.
The manufacturer of a network interface such as a network card should give it a unique address.
For many years now however it's been relatively easy to change the MAC address.
You can do that thanks to the drivers that come with the device or using a program you download from
the Internet no matter what environment the program is dedicated for.
It will allow you to easily change the MAC address in real time.
You can even have more than one such address at a time to conclude you send headers of higher layer
packets and actual data in either net protocol frames because we're at the lower layer.
This can be controlled at only the ether net frim header must contain MAC addresses of the sender and
receiver of the packet.
The rules that govern MAC address distribution are very simple.
If both the sender and the receiver belong to the same local network the sender sends the frame directly
to the receiver.
However if that's not the case the sender since the packet to the router in Windows operating systems
the router is called the default gateway when the packet reaches the gateway it's no longer the sender's
concern.
It's the Gateway's test to deliver it to the receiver.
The question remains how does the sender the host that initiates the connection know the MAC address
of the receiver
in accordance with RAFC standards.
A local network host that doesn't know the MAC address of the receiver.
Since this so-called broadcast to all of their hosts in the network the broadcast is a request for a
specific MAC address.
You can see a sample request in the picture below.
It contains all requests for MAC addresses of the neighboring machines.
One of them should respond to the request when a remote host does respond.
Their response is in no way verified by the sender
the sender trusted the response came from the host identified by the requested MAC address.
The AARP protocol as with all other lower layer Protocols of the OS type model is stateless.
There's no way to make sure that the response corresponds to the request the request was sent to all
machines and the response is not verified.
What makes the attack even easier is that the AARP protocol can announce its MAC address to neighboring
machines without being asked to no one and nothing verifies whether such information is true.
Please also remember that as we mentioned before a network interface.
MAC address can be changed at any time nowadays virtually any network card can be put in promiscuous
mode.
The network card is a device whose task is to receive and send packets and also filter out packets that
are addressed to a given machine.
A properly working network card rejects packets addressed to someone else.
Those that had the wrong MAC address the Internet Protocol header in the promiscuous mode.
The card accepts all packets passing through the medium that it's connected to.
These include packets addressed to another machine all of the above.
The promiscuous mode the possibility to change the MAC address and gratuitous error messages can be
exploited in an attack called Mac spoofing.