1. Address Resolution Protocol
A R P

2. I need the MAC address of machine with IP 192.168.1.69
I need to encapsulate it in a frame
ARP!!
I want to send a packet to the machine with IP address
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
CC:A4:F7:99:CA:76
A packet cannot be sent directly to the medium. It has to be inside a frame
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

3. ARP (Address Resolution Protocol)
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
ARP
(Address Resolution Protocol)
To find out the MAC address of a machine given its IP address
CC:A4:F7:99:CA:76
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

4. Now, I can create the frame I need to send ARP request BROADCAST
¿Who has the MAC address for ?
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
CC:A4:F7:99:CA:76
I am and my MAC address is F0:CC:5B:34:BB:09
ARP reply
UNICAST
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

5. Do I have to do this for every packet?
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
Do I have to do this for every packet?
CC:A4:F7:99:CA:76
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

6. ARP cache ARP cache Dir IP Dir MAC 192.168.1.69 F0:CC:5B:34:BB:09
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
CC:A4:F7:99:CA:76
ARP cache
Dir IP
Dir MAC
F0:CC:5B:34:BB:09
ARP cache
Dir IP
Dir MAC
CC:A4:F7:99:CA:76
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

7. Dir IP Dir MAC Dir IP Dir MAC Dir IP Dir MAC Dir IP Dir MAC
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
Dir IP
Dir MAC
CC:A4:F7:99:CA:76
F0:CC:5B:34:BB:09
FA:BC:98:94:8C:c2
CC:A4:F7:99:CA:76
Dir IP
Dir MAC
F0:CC:5B:34:BB:09
09:FC:6B:CC:D2:55
FA:BC:98:94:8C:c2
Dir IP
Dir MAC
CC:A4:F7:99:CA:76
09:FC:6B:CC:D2:55
F0:CC:5B:34:BB:09
FA:BC:98:94:8C:c2
Dir IP
Dir MAC
CC:A4:F7:99:CA:76
09:FC:6B:CC:D2:55
FA:BC:98:94:8C:c2
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

8. ARP packet F0:CC:5B:34:BB:09 192.168.1.69 CC:A4:F7:99:CA:76
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
ARP packet
Hardware Type
Protocol Type
Hardware Lentgh
Protocol Length
Operation
Request 1, Reply 1
Sender Hardware Address
(6 bytes for Ethernet)
Sender Protocol Address
(4 bytes for IP)
CC:A4:F7:99:CA:76
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

9. ARP Request 1 800h 6 4 CC:A4:F7:99:CA:76 192.168.1.101
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
ARP Request 1
800h 6 4
CC:A4:F7:99:CA:76
00:00:00:00:00:00
CC:A4:F7:99:CA:76
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

10. ARP Reply 1 800h 6 4 2 F0:CC:5B:34:BB:09 192.168.1.69
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
ARP Reply 1
800h 6 4 2
F0:CC:5B:34:BB:09
CC:A4:F7:99:CA:76
CC:A4:F7:99:CA:76
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

11. FCS F0:CC:5B:34:BB:09 192.168.1.69 CC:A4:F7:99:CA:76 192.168.1.101
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F 1
800h 6 4
CC:A4:F7:99:CA:76
00:00:00:00:00:00
CC:A4:F7:99:CA:76
FCS
806h
CC:A4:F7:99:CA:76
FF:FF:FF:FF:FF:FF
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

12. F0:CC:5B:34:BB:09 192.168.1.69 CC:A4:F7:99:CA:76 192.168.1.101
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F 1
800h 6 4 2
F0:CC:5B:34:BB:09
CC:A4:F7:99:CA:76
CC:A4:F7:99:CA:76
CC:A4:F7:99:CA:76
F0:CC:5B:34:BB:09
806h
FCS
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

13. ARP Poisoning Attack (Man In the Middle)
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
ARP Poisoning Attack
(Man In the Middle)
CC:A4:F7:99:CA:76
FA:BC:98:94:8C:c2
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

14. Attacker AA:6D:88:76:BA:6F 192.168.1.123 CC:A4:F7:99:CA:76
Dir IP
Dir MAC
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
F0:CC:5B:34:BB:09
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
CC:A4:F7:99:CA:76
Attacker
FA:BC:98:94:8C:c2
666
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

15. AA:6D:88:76:BA:6F 192.168.1.123 CC:A4:F7:99:CA:76 192.168.1.101
Dir IP
Dir MAC
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
F0:CC:5B:34:BB:09
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
F0:CC:5B:34:BB:09
CC:A4:F7:99:CA:76
ARP reply
I am
And my MAC is:
F0:CC:5B:34:BB:09
FA:BC:98:94:8C:c2
666
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09

16. AA:6D:88:76:BA:6F 192.168.1.123 CC:A4:F7:99:CA:76 192.168.1.101
09:FC:6B:CC:D2:55
AA:6D:88:76:BA:6F
CC:A4:F7:99:CA:76
FA:BC:98:94:8C:c2
666
F0:CC:5B:34:BB:09
F0:CC:5B:34:BB:09