Qtech QSW-3900-48-SFP-DC [165/245] Arp spoofing

QTECH Software Configuration Manual

12-164

12.2 ARP spoofing

Address Resolution Protocol (ARP) spoofing, also known as ARP poisoning or ARP Poison Routing

(APR), is a technique used to attack an Ethernet wired or wireless network. ARP Spoofing may allow an attacker to

sniff data frames on a local area network (LAN), modify the traffic, or stop the traffic altogether (known as a denial

of service attack). The attack can only be used on networks that actually make use of ARP and not another method of

address resolution.

The principle of ARP spoofing is to send fake, or "spoofed", ARP messages to an Ethernet LAN. Generally,

the aim is to associate the attacker's MAC address with the IP address of another node (such as the default gateway).

Any traffic meant for that IP address would be mistakenly sent to the attacker instead. The attacker could then choose

to forward the traffic to the actual default gateway (passive sniffing) or modify the data before forwarding it

(man-in-the-middle attack). The attacker could also launch a denial-of-service attack against a victim by associating a

nonexistent MAC address to the IP address of the victim's default gateway.

ARP spoofing attacks can be run from a compromised host, or from an attacker's machine that is connected

directly to the target Ethernet segment.

A typical Ethernet frame. A spoofed frame could have false source MAC addresses to trick devices on the network.

12.2.1 How ARP spooing works?

The attacker send fake arp message to the victim causing it to update its ARP table with false entries.

The ARP attack works as follow :

1) The attacket send ARP messages to the victim with false updates

2) The victim update its ARP table with the attacker MAC address and the false IP address provided by the

attacker

3) When the victim is ready to send data (Ping in our case) it will send it using mac address listed in its ARP

Table (the attacker's)

12.2.2 ARP Spoofing/poising Animation

The attacker is constently sending false ARP messages to the victim causing it to update its ARP table.

When you ready to send Ping, watch closley where the ping goes.

12.3 ARP-Proxy

Proxy ARP (Address Resolution Protocol) is a technique by which a device on a given network answers

the ARP queries for a network address that is not on that network. The ARP Proxy is aware of the location of the

traffic's destination, and offers it's own MAC address in reply, effectively saying, "send it to me, and I'll get it to

where it needs to go." Serving as an ARP Proxy for another host effectively directs LAN traffic to the Proxy. The

"captured" traffic is then typically routed by the Proxy to the intended destination via another interface or via a

tunnel.

The process which results in the node responding with its own MAC address to an ARP request for a

different IP address for proxying purposes is sometimes referred to as 'publishing'.

For more details of configuration of Proxy-ARP please refer to ARP proxy configuration