‫Address resolution protocol, AAP is a network layer protocol used for mapping a network address, such
‫as an IPv4 address to a physical address, such as a Mac address.
‫To simulate how the AARP mechanism works, we have a small network in the slide, a switch on top and
‫three computers connected to it Computer A wants to talk to computers see.
‫It puts an AAP request onto the wire, which happens to be broadcast.
‫Essentially, what it's saying is who has computer seized Mac address?
‫Of course, because it's a broadcast, every system on the network hears it.
‫Does everybody respond?
‫Well, what happens is that be here is that a is looking for the Mac address of computers, see?
‫B knows that it's not Computer C and therefore does not respond to the broadcast.
‫The broadcast, the AAP request goes out to every system, but the only system that will reply is computer
‫see with an AAP reply.
‫In other words, Computer says who has the Mac address of computer C. And although all the workstations
‫here, the question only C replies and says, I've got the Mac address of Computer C..
‫And this is what it is.
‫So they are.
‫Reply sends back the Mac, address the computer a.
‫And each of these machines start building and our table.
‫So what is the ARP table?
‫Since computers cannot send broadcast messages every time they need to connect with another network
‫device, they store the IP addresses and the corresponding Mac addresses of systems they frequently
‫communicate with in a table called Arp Table.
‫All the systems in the LAN maintain this table.
‫The entries in the ARB cash table are generally short lived and are updated every 15 to 20 minutes.
‫Now let's get back to our topic.
‫Can we say that one of the passive scan methods is just looking into the ARP table of a system, which
‫is a network that we are scanning?
‫Well, sure we can.
‫Inside an RV table, we see the IP addresses of some of the systems of the network and their corresponding
‫Mac addresses.
‫Let's see the ARP tables in three different platforms.
‫Mac OS, Windows and Debian Linux.
‫We are in a Mac OS operating system, first open the terminal first type terminal in the search box
‫of the applications window, which brings you the terminal application.
‫Typing Arp and hitting enter shows a small help for ARP command.
‫If you want to see detailed help about the AAP command, you can use man command type M.E.N: R.P. and
‫hit enter.
‫You'll get detailed help.
‫A parameter is used to display all current ARP table entries, but hold on.
‫It says A is used to delete all entries as well.
‫How can that be?
‫Well, to delete an ARP table entry, you use D parameter.
‫If you use this parameter with a parameter, you are able to delete all entries of ARP tables.
‫I parameter is used to see the entries of a single interface.
‫By default, ARP Command tries to show the display addresses symbolically.
‫To see the IP addresses instead of display names of the systems you have to use and parameter.
‫Which means do not resolve names.
‫OK.
‫Press cue to quit the man page of the art command now type LP Dash and to see all the entries of the
‫ARP table.
‫Since macOS is a BSD based operating system, the results of the ARP command is displayed in BSD style.
‫Saga Machine is a Microsoft Windows eight.
‫Let's open a command prompt first.
‫I have a shortcut on my status bar, so I click it to start a command prompt.
‫Alternatively, press windows plus are buttons open the dialog box.
‫Run Command and hit enter.
‫If you type in a Windows system, the help page of ARP command is displayed.
‫Type AAP Dash A to see the entries of the ARP table, in my opinion, this display is more, I don't
‫know, human readable than BSD style.
‫Now, although we're not interested in these at the moment, I would like to talk a little about the
‫IP addresses that start with 224 to calm your curiosity.
‫Two two four zero zero two two is the multicast address for Internet Group Management Protocol two two
‫four zero zero two five two is used by recent versions of Windows for Link Local Multicast Name Resolution
‫L-l and are searching for local network computers.
‫The third machine is Our Colleague, which is a Debian based Linux operating system.
‫Open the terminal window if you type ERP and hit.
‫Enter the ARP table.
‫Entries are displayed in a human readable format.
‫As you see, systems are listed with a known domain name such as UWW Dot, OWASP, BW, Wacom by default.
‫AARP Dash H brings you a small help page if you want a detailed help page type men space.
‫AAP.
‫In a Debian based Linux system, Dash eight parameter of Arp command is used to see the entries in BSD
‫format, which we saw in Mac OS.
‫Dash is again to see the entries of a single interface.
‫OK, press Q to quit the man page.
‫AARP Dash A displays are table entries in BSD format and use any parameter to see the IP addresses instead
‫of domain names of the system's.