- [Narrator] Packet analysis has many
other useful applications
in network security besides troubleshooting.
One such application is network security reconnaissance.
Packet analysis helps you detect ping sweeps
or port-scanning attempts.
It also allows you to detect information leakage
or attacks such as Address Resolution Protocol
or ARP poisoning.
ARP is a protocol used to exchange information
on mappings between IP addresses and ethernet addresses.
Why is ARP necessary?
Because we have a two-tiered addressing system
in computer networking.
One for Local Area Networks or LANs
and the other for the internet.
Have you heard of the term ethernet address.
In a local area network or LAN,
we use an address type called ethernet address.
When we send the message outside of the LAN,
we use a different type of address called IP address.
Whenever a message arrives at a LAN,
that message must be using the ethernet address again,
therefore there's this need
for translating the IP address into
an ethernet address which is what ARP does.
To recap, there are two different types
of network addresses.
The first is the internet protocol or IP address
used by routers to pass packets from one network to another.
There is another type of address
which is ethernet address used
by network interface cards or NICs
to pass frames from one host to another.
After a packet arrives at a router,
representing its destination network,
it needs to be using the ethernet address
to navigate the router's LAN.
Here is how ARP works,
in the very beginning,
if there is a need for finding out
an ethernet address version of a particular IP address
on ARP cache is first checked.
In this case, a cache is just a memory space remembering
the ethernet address and the IP address mappings.
If the mapping is already there,
you don't have to do any more searches.
If the mapping is not there, a new ARP request is sent.
This ARP request is sent to all the hosts in the network.
If one of the hosts has the right IP address
it knows what ethernet address corresponds
to the IP address.
The host then sends the ethernet address information
back to the host that made the ARP request originally.
finally, the right mapping between the IP address
and the ethernet address has been discovered.
ARP protocol is vulnerable to attacks.
An attacker will send a fake response to the ARP request
after the legitimate host sends its IP address
information back to the ARP requester.
Therefore whoever sent out the ARP request
now recognizes the attacker
as a legitimate host with the right IP.
The victim host start sending packets
to the attacker host.
The attacker host intercepts the packets
and passes them on to the legitimate host.
The attacker essentially established
this man in the middle of tech loop
at the end of the process.
In this scenario a packet analysis tool like Wireshark
can detect the duplicate responses
sent back to the ARP request
therefore serving as an excellent network security tool.