Hey everybody and welcome to the last video on protocols.
So in this video we're gonna be going over something called art.
Now what is art art is a dress resolution protocol.
This is similar to DNS.
And in the Not Face and in the fact that it resolves to something.
Now this resolves a IP address into a MAC address which is important because the MAC address is used
a lot in getting packets where they need be.
Now how does this work when a client tries to send a packet to another node it will first try to resolve
the IP address first try to resolve the hostname to an IP do DNS and then if it can't resolve that if
it already has the or it or it did resolve that but it already has the IP it will use check the local
cache ARP table or the ARB cache table to see if the IP already has the MAC address listed there if
it does exist it will send the traffic like normal to the correct MAC address.
However if it does not it needs to go a little step further.
So what happens next if the Mac can't be found in the cache it sends a request to the broadcast address
which we talked about earlier the request will literally say who has and then this IP address.
Now only the node with that IP address should respond.
It says I am this IP address which in that broadcast address you will then see the MAC address of that
of that machine and then it takes the MAC address of that machine in the IP and stores it into the ARB
cache for future communications.
Now what's also important here is that ARB will periodically check and reach and reach re ask who has
what IP based on what's in the table because the table is consistent of what you normally talk to or
your machine talked to on a consistent basis.
But it also wants to make sure that the machine didn't change.
So it will periodically every 10 20 30 seconds a minute it will go and check who has this eye who has
all these IP addresses and then they all respond.
It updates the cache so it's important understand that that happens because there is an attack called
Art poisoning that somebody can do.
So this is commonly performed with a man in the middle attack where an attacker will sit in between
a client and a router and then inspect all the traffic in intended for the router and then forward it
off to the router and then back again.
So you kind of sit in the middle but you're able to watch the entire traffic so somebody logs and you
can see the password so since ARB will try this refresh on its cache an attacker can take advantage
of that refresh process when they send when an attacker will consistently send out I am and then the
IP address of the Gateway or the router lets say so when a client tries to issue that refresh rates
as who has blank for the router then it will already have seen the response from the attacker saying
that oh this guy already has this guy's router and it will respond with the wrong IP the wrong Mac so
that way or I'm sorry the right IP that's incorrect it's not the wrong IP it's the wrong MAC address
so to spot the right IP but it will have the wrong MAC address.
So because of that it will then poison the ARP table to be not valid.
So when it looks when you go to send something to your gateway instead of it going to the correct MAC
address to the Gateway it instead goes to the attacker which then they can send off to the gateway the
true gateway and then have the response come back and it just forwards a traffic now.
Linux has a nifty traffic forward option so you can just set that enabled and then it'll just send traffic
back and forth so you can use your servers your host as a proxy sort of speak but the attacker in most
cases won't notice.
However if on an enterprise network if you try flooding a network with our responses saying you are
the IP address of whoever without having been asked firewalls intrusion detection systems are going
to lose it.
They will know it's happening.
They're not dumb.
This is not a new attack.
This is fairly common on smaller networks you're not going to have this protection.
But on a larger enterprise networks where intrusion detection is is there you're not going to be able
to do this as easily as explained here.