Topic: ARP Poisoning attacks
Student-Name: Rushad Shaikh
Abstract:
I will explain some basics about the ARP protocol and ARP poisoning attacks. ARP
poisoning is a technique for attacking networks which can be very effective. IP
addresses are used for sending/receiving data, from one machine to another in the
network environment. A gateway is usually present to make sure those packets which
are not intended for the local subnet are sent to their destination. The problem with this
is: an interface gets lots of packets and should deliver only those that are meant for that
specific interface. But the interface itself doesn't know what its IP address is. So there
we have a problem: we address by IP address, but the part that determines whether a
packet is meant for him, doesn't know the IP address. The solution for this is ARP.
When host 10.0.0.1 with mac AA:AA:AA:AA:AA:AA wants to send data to host
10.0.0.2 it sends a request to the ethernet broadcast address. This request contains the
IP and MAC of the interface that did the request (10.0.0.1 and
AA:AA:AA:AA:AA:AA) and the IP that it needs to know. A lot of hosts will receive
this packet. The machine with the same IP address will reply . This ARP reply is sent to
the MAC address of the interface that did the request and will contain both IP and
MAC of both the machine that did the first request as well as the machine that gave a
reply.
About the attackTo prevent immense amounts of ARP traffic, the operating system keeps an ARP table
cached. If this wouldn't be done, each ethernet frame to send would require an arp
request, which would probably triple your network traffic. So the OS on 10.0.0.2 knows
that it should send packets meant for 10.0.0.1 to MAC AA:AA:AA:AA:AA:AA. What
if we would tell 10.0.0.2 that the MAC of 10.0.0.1 is something else?
I will also talk about Man in the Middle attack.
In my presentation I will talk about –
1. What is ARP Protocol?
2. Why it’s used?
3. Write and run a program in java to simulate a network to show how ARP requests
are made over the network.
4. Then I will talk about the ARP Attack