1. ARP Spoofing

2. What is ARP ？
The Address Resolution Protocol (ARP) is a communication protocol used for discovering the link layer address, such as a MAC address, associated with a given network layer address, typically an IPv4 address.
This mapping is a critical function in the Internet protocol suite.

3. What is ARP Spoofing ？
In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network.
Generally, the aim is to associate the attacker's MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.

4. Type
Length
Operation
Sender Address
Target Address

5. Everyone can send any fake packet to anyone
Everyone can send any fake packet to anyone. Everyone believes all the packet they received. When a new REPLY packet comes,it overlaps the old record even NO REQUEST packet has been sended.

6. MONKEY-IN-THE-MIDDLE
Router
Target IP + Attacker MAC
Router IP + Attacker MAC
Attacker
MONKEY-IN-THE-MIDDLE
Target
1.Use ARP REQUEST to get the Router and Target’s IP and MAC address;
2.Send crafted ARP REPLY packet to get all the packets send from Target to Router;
3.Send crafted ARP REPLY packet to get all the packets send from Router to Target.

7. Presentation

8. Static binding of IP & MAC
Reject unsolicited ARP REPLY packet
Inspect 1 IP maps N MAC

12. Student work:
There is a famous ARP Spoofing tool arpspoof, your job is to comment the arpspoof’s source code, recompile it and add your own mark in the code(e.g. print your name and student id while using this command line tool). After that, use it.
Upload the commented code, executable, experiment report to our FTP File Server, address is ftp:// /, user & password both are xxaqdl.
Get more instructions on the Blackboard’s forum.
The detail describe of this experiment will be upload to FTP

13. Ip 地址
Mac地址 类型
ea-93-4a 动态
00-0c e5
After

14. # echo 1 >/proc/sys/net/ipv4/ip_forward
arpspoof -i etho -t
arpspoof -i etho -t