Scribd Logo
Upload

Welcome to Scribd!

  • 111 views

    Arp

    Uploaded by

    Alexandru Efimov

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    Arp

    Uploaded by

    Alexandru Efimov
    111 views32 pages

    Original Title

    arp

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    111 views32 pages

    Arp

    Uploaded by

    Alexandru Efimov

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 32

    Laura Chappell presents

    TM

    Analyzing and Troubleshooting Address Resolution Protocol (ARP)


    A detailed look at ARP operations including gratuitous ARPs, ARP faults, proxy ARP and ARP storms.

    Course Contents
    Why ARP? Typical ARP functionality Reading ARP tables ARP packet structures Gratuitous ARPs Proxy ARP ARP scans ARP analysis exercise

    Why ARP?
    ftp CORPFS1
    Destination MAC of server? Source MAC: A EtherType: 0x0800 Protocol: Source IP: Destination IP: Source Port: Destination Port: 6 (TCP) 10.1.0.1 10.2.99.99 1024 21 Eth

    MAC address resolution

    CORPFS1

    MAC: Media Access Control

    TCP

    IP

    Why ARP?
    ftp CORPFS1

    Router
    MAC address resolution

    Destination MAC of router? Source MAC: A EtherType: 0x0800 Protocol: Source IP: Destination IP: Source Port: Destination Port: 6 (TCP) 10.1.0.1 10.2.99.99 1024 21

    TCP

    IP

    Eth

    CORPFS1

    Why ARP?
    Step 1

    ftp CORPFS1
    Step 2

    Translate ftp to port number 21

    Get host IP address TX (Resolver Process)


    Step 3

    Local or remote destination?

    Why ARP?
    Step 1

    ftp CORPFS1
    Step 2

    Translate ftp to port number 21

    Get host IP address TX (Resolver Process)


    Step 3

    Local or remote destination?


    Step L1

    Get MAC address (ARP)

    TX

    CORPFS1

    Why ARP?
    Step 1

    ftp CORPFS1
    Step 2

    Translate ftp to port number 21

    Get host IP address TX (Resolver Process)


    Step 3

    Local or remote destination?


    Step R1

    Lookup route information Get MAC address TX (ARP)

    Step R2

    R CORPFS1

    ARP Requests and Responses


    1
    ARP Request Broadcast Source hardware address: A Source network address: 10.1.0.1 Target hardware address: 0x000000000000 Target network address: 10.1.0.99

    Client A Hardware: A Network: 10.1.0.1

    Server 1 Hardware: D Network: 10.1.0.99

    ARP Requests and Responses


    2
    ARP Reply Unicast Source hardware address: D Source network address: 10.1.0.99 Target hardware address: A Target network address: 10.1.0.1

    Client A Hardware: A Network: 10.1.0.1

    Server 1 Hardware: D Network: 10.1.0.99

    ARP Frame Format


    RFC 826
    0 HARDWARE TYPE HARDWARE ADDRESS LENGTH PROTOCOL ADDRESS LENGTH SENDER HARDWARE ADDRESS SENDER HARDWARE ADDRESS (continued) SENDER PROTOCOL ADDRESS (continued) SENDER PROTOCOL ADDRESS TARGET HARDWARE ADDRESS DATA LINK HEADER 15 16 PROTOCOL TYPE OPERATION 31

    TARGET HARDWARE ADDRESS (continued) TARGET PROTOCOL ADDRESS

    ARP Request Packet Format

    ARP Response Packet Format

    Ref

    arp trace file

    Reading the ARP Tables


    Microsoft(R) Windows DOS (C)Copyright Microsoft Corp 1990-1999. C:\>arp -a Interface: 10.234.12.108 on Interface 0x1000003 Internet Address Physical Address Type 10.234.12.1 00-01-96-3c-3f-54 dynamic 10.234.13.1 00-01-96-33-35-15 dynamic 10.234.16.1 00-01-96-bc-af-54 dynamic 10.234.24.1 00-01-96-ac-ff-24 dynamic 10.234.12.1 00-01-96-73-7f-1a dynamic 10.234.16.1 00-01-96-34-cf-b4 dynamic 10.234.112.1 00-01-96-36-3d-5c dynamic 10.234.90.1 00-01-96-38-ef-d4 dynamic

    Adding Static Entries


    Microsoft(R) Windows DOS (C)Copyright Microsoft Corp 1990-1999. C:\>arp s 10.44.22.1 00-00-1b-ac-44-a1 C:\>arp -a Interface: 10.234.12.108 on Interface 0x1000003 Internet Address Physical Address Type 10.234.12.1 00-01-96-3c-3f-54 dynamic 10.234.13.1 00-01-96-33-35-15 dynamic 10.34.2.1 00-aa-00-62-c6-09 static 10.44.2.1 00-00-1b-ac-44-a1 static

    Gratuitous ARPs

    Ref

    g-arp trace file

    Proxy ARP
    1
    ARP Request Broadcast Source hardware address: A Source network address: 10.1.0.1

    Target hardware address: 0x000000000000 Target network address: 10.2.77.33

    Client A IP Address: 10.1.0.1: Mask: 255.0.0.0 Hardware Address: A

    Router

    Server 1 IP Address: 10.2.77.33: Mask: 255.0.0.0 Hardware Address: D

    Interface 1: IP Address: 10.1.0.33 Mask: 255.255.0.0 Hardware Address: B

    Interface 2: IP Address: 10.2.0.33 Mask: 255.255.0.0 Hardware Address: C

    Proxy ARP
    2
    ARP Reply Unicast Source hardware address: B Source network address: 10.2.77.33 Target hardware address: A Target network address: 10.1.0.1

    Client A IP Address: 10.1.0.1: Mask: 255.0.0.0 Hardware Address: A

    Router

    Server 1 IP Address: 10.2.77.33: Mask: 255.0.0.0 Hardware Address: D

    Interface 1: IP Address: 10.1.0.33 Mask: 255.255.0.0 Hardware Address: B

    Interface 2: IP Address: 10.2.0.33 Mask: 255.255.0.0 Hardware Address: C

    Proxy ARP Tables


    Microsoft(R) Windows DOS (C)Copyright Microsoft Corp 1990-1999. C:\>arp -a Interface: 10.234.12.108 on Interface 0x1000003 Internet Address Physical Address Type 10.234.12.1 00-01-96-3c-3f-54 dynamic 10.193.13.1 00-01-96-3c-3f-54 dynamic 10.34.16.1 00-01-96-3c-3f-54 dynamic 10.23.24.1 00-01-96-3c-3f-54 dynamic 10.55.12.1 00-01-96-3c-3f-54 dynamic 10.31.16.1 00-01-96-3c-3f-54 dynamic 10.31.112.1 00-01-96-3c-3f-54 dynamic 10.31.90.1 00-01-96-3c-3f-54 dynamic

    ARP Fault
    ARP Request Broadcast Source hardware address: A Source network address: 10.1.22.4 Target hardware address: 0x000000000000 Target network address: 10.2.12.4

    Router
    Client A Network address: 10.1.22.4 Network mask: 255.0.0.0 Hardware address: A Server 1 Network address: 10.2.12.4 Network mask: 255.255.0.0 Hardware address: D

    Cyber Crime: ARP Scans

    ARP Analysis
    Open the trace file arp-x.cap/pkt/dmp. Examine this ICMP echo request/reply process between two devices that sit on the same network. Based on the packets in this trace, what are the possible ARP table entries for: 10.234.10.77 10.234.12.108 What might cause this strange type of communication?

    The session is paused. Click to start session again.

    Packet #1

    Packet 1 Implies

    ICMP Echo

    Client A Network address: 10.234.10.77 Network mask: 255.255.0.0 Hardware address: 0x00-20-78-e1-59-6e

    Server Network address: 10.234.12.108 Network mask: 255.255.0.0 Hardware address: 0x00-00-00-00-00-00

    Packet #2

    Packet 2 Implies
    Intermediary Device Network address: unknown Network mask: unknown Hardware address: 0x00-01-96-3c-3f-a8

    ICM

    o Ech P

    Client A Network address: 10.234.10.77 Network mask: 255.255.0.0 Hardware address: 0x00-20-78-e1-59-6e

    Server Network address: 10.234.12.108 Network mask: 255.255.0.0 Hardware address: 0x00-00-00-00-00-00

    Packet #3

    To Intermediary

    Packet #4

    From Intermediary

    Were Seeing
    Intermediary Device Network address: unknown Network mask: unknown Hardware address: 0x00-01-96-3c-3f-a8

    ?
    IC MP Ec ICM ho PE ch oR ep

    o Ech P y CM epl I R ho c PE ICM


    Client A Network address: 10.234.10.77 Network mask: 255.255.0.0 Hardware address: 0x00-20-78-e1-59-6e

    ly

    Server Network address: 10.234.12.108 Network mask: 255.255.0.0 Hardware address: 0x00-d0-59-aa-af-80

    ARP Tables
    Intermediary Device
    Internet Address Physical Address 10.234.10.77 0x00-20-78-e1-59-6e 10.234.12.108 0x00-01-96-3c-3f-a8

    Client A

    Server

    Network address: 10.234.10.77


    Internet Address Physical Address 10.234.12.108 0x00-01-96-3c-3f-a8

    Network address: 10.234.12.108


    Internet Address Physical Address 10.234.10.77 0x00-01-96-3c-3f-a8

    What Could Cause This?


    Intermediary Device Man-in-the-Middle (MiM) Attack Internet Address Physical Address 10.234.10.77 0x00-20-78-e1-59-6e Subnet Masks Too Long (255.255.255.0) 10.234.12.108 0x00-01-96-3c-3f-a8

    Client A

    Server

    Network address: 10.234.10.77


    Internet Address Physical Address 10.234.12.108 0x00-01-96-3c-3f-a8

    Network address: 10.234.12.108


    Internet Address Physical Address 10.234.10.77 0x00-01-96-3c-3f-a8

    Conclusion
    ARP is fundamental for communicating with local devices ARP structures are interesting with no IP header in the packets Proxy ARP allows devices to cross routers even though they believe they are talking to local devices Gratuitous ARP helps resolve duplicate IP address problems ARP scans may precede an attack ARP tables can be altered manually

    Conclusion
    This is Laura Chappell This has been Analyzing and Troubleshooting ARP (Address Resolution Protocol)

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy