1. ARP Poisoning Rushad Shaikh CSCI 5931 Web Security Spring 2004

2. ARP Poisoning Attacks Topics –Logical Address –Physical Address –Mapping –ARP –ARP Cache Table –ARP Poisoning –Prevent ARP Poisoning

3. Logical address Internetwork address Unique universally In TCP/IP its called IP Address 32 bits long Physical Address Local address Unique locally

4. Mapping Delivery of a packet requires two levels of addressing –Logical –Physical Mapping a logical address to its physical address –Static Mapping Table to store information Updating of tables –Dynamic Mapping ARP –Logical Address to Physical Address RARP –Physical Address to Logical Address

5. ARP ARP request –Computer A asks the network, "Who has this IP address?“

6. ARP(2) ARP reply –Computer B tells Computer A, "I have that IP. My Physical Address is [whatever it is].“

7. Cache Table A short-term memory of all the IP addresses and Physical addresses Ensures that the device doesn't have to repeat ARP Requests for devices it has already communicated with Implemented as an array of entries Entries are updated

8. State Queue Attempt Time-out IP AddressPhysical Address R5900 180.3.6.1ACAE32457342 P22 129.34.4.8 P145 201.11.56.7 R8450 114.5.7.89457342ACAE32 P121 220.55.5.7 F R960 19.1.7.824573E3242ACA P183 188.11.8.71 Cache Table

9. ARP Poisoning Simplicity also leads to major insecurity –No Authentication ARP provides no way to verify that the responding device is really who it says it is Stateless protocol –Updating ARP Cache table Attacks –DOS Hacker can easily associate an operationally significant IP address to a false MAC address –Man-in-the-Middle Intercept network traffic between two devices in your network

10. ARP Poisoning(3a) – Man-In-The-Middle

11. ARP Poisoning(3b) – Man-In-The-Middle

12. ARP Poisoning(3c) – Man-In-The-Middle

13. Prevent Arp Poisoning For Small Network –Static Arp Cache table For Large Network –Arpwatch As an administrator, check for multiple Physical addresses responding to a given IP address

14. References: www.watchguard.com/infocenter/editorial/135324.asp www.l0t3k.org/security/docs/arp/