Address Resolution Protocol AAFP is a network layer protocol used for mapping a network address such
as an IP v4 address to a physical address such as a Mac address.
To simulate how the ARPU mechanism works, we have a small network in the slide, a switch on top and
three computers connected to it.
Computer wants to talk to computers, see?
It puts an ARP request onto the wire, which happens to be broadcast, essentially what it's saying
is who has computers, his Mac address.
Of course, because it's a broadcast, every system on the network hears it.
Does everybody respond well, what happens is that B hears that A is looking for the Mac address of
Computer C.
B knows that it's not computer C and therefore does not respond to the broadcast.
The broadcast, the AAP request goes out to every system, but the only system that will reply is computer
see with an AAP reply.
In other words, Computer says, who has the Mac address of a computer, see?
And although all the workstations here, the question only C replies and says, I've got the Mac address
of computer C and this is what it is.
So they are purply sends back the Mac address, the computer A and each of these machines start building
an ark table.
So what is the ARP table?
Since computers cannot send broadcast messages every time they need to connect with another network
device, they store the IP addresses and the corresponding MAC addresses of systems they frequently
communicate with in a table called ARP Table.
All the systems in the land maintain this table.
The entries in the Aakash table are generally short lived and are updated every 15 to 20 minutes.
Now, let's get back to our topic.
Can we say that one of the passive scan methods is just looking into the ARP table of a system which
is a network that we are scanning?
Wow, sure we can.
Inside an art table, we see the IP addresses of some of the systems of the network and their corresponding
MAC addresses.
Let's see the tables in three different platforms, Mac OS, Windows and Debian Linux.
We are in a Mac OS operating system, first open the terminal, first type terminal in the search box
of the applications window, which brings you the terminal application typing AARP and hitting enter
shows a small help for our common.
If you want to see detailed help about the art command, you can use man command type MRN, AARP and
hit enter, you'll get detailed help.
A parameter is used to display all current ARP table entries, but hold on, it says A is used to delete
all entries as well.
How can that be?
Well, to delete an ARP table entry, you use the parameter.
If you use this parameter with a parameter, you are able to delete all entries of our tables.
IE parameter is used to see the entries of a single interface by default.
ARP Command tries to show the display addresses symbolically.
To see the IP addresses instead of display names of the systems, you have to use any parameter.
Which means do not resolve names.
OK, press cue to quit the man page of the command now type IRP Dash and to see all the entries of the
art table.
Since Mac OS is a BSD based operating system, the results of the command is displayed in BSD style.
Sagger machine is a Microsoft Windows eight.
Let's open a command prompt first, I have a shortcut on my status bar, so I click it to start a command
prompt.
Alternatively, press windows, plus are buttons, open the dialog box, run command and hit enter.
If you type AARP and a Windows system, the help page of our command is displayed.
Type IRP Dash A to see the entries of the art table, in my opinion, this display is more, I don't
know, human readable than BSD style.
Now, although we're not interested in these at the moment, I would like to talk a little about the
IP addresses that start with two to four to calm your curiosity.
Two two four zero zero two two is the multicast address for Internet group management protocol two to
four zero zero two five two is used by recent versions of Windows four link local multicast name resolution
L.M. and are searching for local network computers.
The third machine is our colleague, which is a Debian based Linux operating system.
Open the terminal window if you type ERP and hit enter the ARP table entries are displayed in a human
readable format.
As you see, systems are listed with a known domain name, such as would always be wacom by default.
AARP dash age brings you a small health page if you want a detailed health page type man space AAFP.
In a Debian based Linux system, that's a parameter of our command is used to see the entries in BSD
format, which we saw in Mac OS, Dash is again to see the entries of a single interface.
OK, press queue to quit the man page AARP dash a display's art table entries in BSD format and use
any parameter to see the IP addresses instead of domain names of the systems.