‫An AP spoof is performed.
‫Replying to an AAP request before the real owner of the IP address.
‫Because of the lack of authentication mechanisms in our protocol, you're able to set yourself as the
‫owner of the ship in the source machines ARP table.
‫OK.
‫To understand the ARB spoof or ARB cache poisoning attack, let's remember the ARB protocol and its
‫principles once again.
‫Address resolution protocol, AAP is a network layer protocol used for mapping a network address, such
‫as an IPv4 address to a physical address, such as a Mac address.
‫To simulate how the ARPU mechanism works, we have a small network in the slide, a switch on top and
‫three computers connected to it Computer A wants to talk to computer see.
‫It puts an AAP request onto the wire, which happens to be broadcast.
‫Essentially, what it's saying is who has computer seized Mac address?
‫Of course, because it's a broadcast, every system on the network hears it.
‫Does everybody respond?
‫Well, what happens is that be here is that a is looking for the Mac address of computer, see?
‫B knows that it's not Computer C and therefore does not respond to the broadcast.
‫The broadcast, the AAP request goes out to every system, but the only system that will reply is computer
‫see with an AAP reply.
‫In other words, computer age says who has the Mac address of a computer see, and although all the
‫workstations hear the question, only see replies and says, I've got the Mac address of computer.
‫See, and this is what it is.
‫So they are.
‫Reply sends back the Mac address to Computer A..
‫And each of these machines start building in our table.
‫These are how AAP requests and responses look in Wireshark, the first packet is an AAP request, as
‫you see it is broadcast.
‫And the second packet is an AAP reply.
‫The owner of the IP two zero seven answers with its Mac address, as you see.
‫Our request is broadcast throughout the network and the first reply is trusted and accepted.
‫OK, so we have already seen the routine of the ARB protocol.
‫Computer sends in our request the request is broadcast.
‫The owner of the ship replies with an ARP reply and both sides update, there are tables.
‫Now we have an attacker in the network.
‫OK, so this is how they are spoof attack works, Computer A wants to talk to computer, see if the
‫Mac address table of Computers C is not in the art table of computer.
‫It puts an art request into the wire, which happens to be broadcast.
‫This is a point where all the computers on the network get the ARP request.
‫So although it's not his IP address, the attacker replies the AAP request before the real owner.
‫And this hour reply, the attacker puts his own Mac address corresponding to the target IP address.
‫Computer receives the art supply and stores the address paper and its ARP table and communication takes
‫place.