Address resolution protocol.
ARP is a network layer protocol used for mapping a network address, such as an IPV four address to
a physical address such as a mac address.
To simulate how the AARP mechanism works.
We have a small network in the slide, a switch on top, and three computers connected to it.
Computer A wants to talk to Computer C.
It puts an ARP request onto the wire, which happens to be broadcast.
Essentially what it's saying is who has computer sees Mac address.
Of course, because it's a broadcast, every system on the network hears it.
Does everybody respond?
Well, what happens is that B hears it.
A is looking for the Mac address of Computer C.
Be knows that it's not computer see, and therefore does not respond to the broadcast.
The broadcast.
The request goes out to every system, but the only system that will reply is computer C with an ARP
reply.
In other words, Computer A says who has the Mac address of Computer C?
And although all the workstations here, the question only C replies and says, I've got the Mac address
of Computer C and this is what it is.
So the ARP reply sends back the Mac address to Computer A and each of these machines start building
an ARP table.
So what is the ARP table?
Since computers cannot send broadcast messages every time they need to connect with another network
device, they store the IP addresses and the corresponding Mac addresses of systems they frequently
communicate with in a table called ARP table.
All the systems in the LAN maintain this table.
The entries in the ARP cache table are generally short lived and are updated every 15 to 20 minutes.
Now let's get back to our topic.
Can we say that one of the passive scan methods is just looking into the ARP table of a system which
is a network that we are scanning?
Well, sure we can.
Inside an ARP table.
We see the IP addresses of some of the systems of the network and their corresponding Mac addresses.
Let's see the ARP tables in three different platforms Mac OS Windows and Debian Linux.
We are in a macOS operating system first open the terminal, first type terminal in the search box of
the applications window, which brings you the terminal application.
Typing ARP and hitting enter shows a small help for ARP command.
If you want to see detailed help about the ARP command, you can use man command.
Type man ARP and hit enter.
You'll get detailed help.
A parameter is used to display all current ARP table entries.
But hold on.
It says A is used to delete all entries as well.
How can that be?
Well, to delete an ARP table entry you use D parameter.
If you use this parameter with a parameter, you are able to delete all entries of ARP tables.
IE parameters used to see the entries of a single interface.
By default, ARP command tries to show the display addresses symbolically.
To see the IP addresses instead of display names of the systems, you have to use n parameter.
Which means do not resolve names.
Okay.
Press.
Q to quit the main page of the ARP Command.
Now type ARP dash a n to see all the entries of the ARP table.
Since macOS is a BSD based operating system, the results of the command is displayed in BSD style.
Second machine is a Microsoft Windows 8.
Let's open a command prompt first.
I have a shortcut on my status bar, so I click it to start a command prompt.
Alternatively, press windows plus buttons, open the dialog box, run command and hit enter.
If you type AARP in a Windows system, the Help page of ARP Command is displayed.
Type AARP a to see the entries of the ARP table.
In my opinion, this display is more.
I don't know, human readable than BSD style.
Now, although we're not interested in these at the moment, I would like to talk a little about the
IP addresses that start with 2 to 4 to calm your curiosity.
224.0.0.22 is the multicast address for internet group management protocol.
224.0.0.252 is used by recent versions of Windows for Link-local multicast name resolution.
N.
Are searching for local network computers.
The third machine is our Kali, which is a Debian based Linux operating system.
Open the terminal window.
If you type ARP and hit enter the ARP table.
Entries are displayed in a human readable format.
As you see, systems are listed with a known domain name such as W-w-w dot owasp Broadway.com.
By default, arp dash h brings you a small help page if you want a detailed help page type man Space
ARP.
In a Debian based Linux system.
A parameter of ARP command is used to see the entries in BSD format which we saw in Mac OS.
Dash I is again to see the entries of a single interface.
Okay, press Q to quit the man page arp dash a displays arp table entries in BSD format and use n parameter
to see the IP addresses instead of domain names of the systems.