Before we're talking about using art tables for passive scanning, let's talk a little bit about art
protocol and mechanism first.
So address resolution protocol.
Art is a network layer protocol used for mapping a network address such as an IPV for address to a physical
address such as a Mac address.
To simulate how the ARPU mechanism works, we have a small network in the Sligh, a switch on top and
three computers connected to it.
Computer A wants to talk to computers, see?
It puts an ARP request onto the wire, which happens to be broadcast.
Essentially what it's saying is who has computer CS Mac address?
Of course, because it's a broadcast, every system on the network hears it.
Does everybody respond?
Well, what happens is that B hears that A is looking for the Mac address of Computer C.
B knows that it's not computer C and therefore does not respond to the broadcast.
The broadcast, the AAP request goes out to every system, but the only system that will reply is computer
see with an AAP reply.
In other words, Computer A says who has the Mac address of computer see?
And although all the workstations here, the question only C replies and says, I've got the Mac address
of computers C and this is what it is.
So the ARP reply sends back the Mac address to computer A..
And each of these machines start building an ark table.
So what is the ARP table?
Since computers cannot send broadcast messages every time they need to connect with another network
device, they store the IP addresses and the corresponding MAC addresses of systems they frequently
communicate with in a table called ARP Table.
All the systems in the land maintain this table.
The entries in the AAB cash table are generally short lived and are updated every 15 to 20 minutes.
Well, let's get back to our topic.
Can we say that one of the passive Skåne methods is just looking into the art table of a system which
is a network that we are scanning?
Well, Joe, we can inside an art table.
We see the IP addresses of some of the systems of the network and their corresponding MAC addresses.
Let's see the arm tables in three different platforms.
Mac OS, Windows and Debian Linux.
We are a Mac OS operating system, first open the terminal, first type terminal in the search box of
the applications window.
Which brings you the terminal application typing AARP and hitting enter shows a small help for our command.
If you want to see detailed health about the art command, you can use MRN, command type MRN, AARP
and hit enter.
You'll get detailed help.
A parameter is used to display all current ARP table entries.
But hold on.
It says A is used to delete all entries as well.
How can that be?
Well, to delete an art table entry, you use D parameter.
If you use this parameter with a parameter, you are able to delete all entries of ARP tables ie parameter
is used to see the entries of a single interface by default.
ARP Command tries to show the display addresses symbolically.
To see the IP addresses instead of display names of the systems you have to use and parameter.
Which means do not resolve names.
OK, press cue to quit the man page of the AAFP command.
Now type AARP dash A.N. to see all the entries of the ARP table.
Since Mac OS is a BSD based operating system, the results of the ARPC command is displayed in BSD style.
Sagen machine is a Microsoft Windows eight.
Let's open a command prompt first.
I've a short cut on my status bar, so I click it to start a command prompt.
Alternatively, press windows force are buttons, open the dialog box.
Run command and hit enter.
If you type HRP in a Windows system, the help page of AAFP command is displayed.
Type LRP dash A to see the entries of the art table, in my opinion, this display is more a. human
readable than BSD style.
Now, although we're not interested in these at the moment, I would like to talk a little about the
IP addresses that start with two to four to calm your curiosity.
Two two four zero zero two two is the multicast address for Internet group management protocol two to
four dot zero zero dot two five two is used by recent versions of Windows four link local multicast
named Resolution L.
L m and are searching for local network computers.
The third machine is our COLLY, which is a Debian based Linux operating system.
Open internal terminal window.
If you type ERP and hit enter the ARP table entries are displayed in a human readable format, as you
see.
Systems are listed with a known domain name such as w w w dot o wasp BW a dot com by default.
AARP dash age brings you a small help page.
If you want a detailed health page type man space AAFP.
In a Debian base, Linnik system dash, a parameter of AAFP command is used to see the entries in BSD
format, which we saw in Mac OS Dash.
I is again to see the entries of a single interface.
OK, press Q to quit the man page AARP dash a display's art table entries in BSD format and use N parameter
to see the IP addresses instead of domain names of the systems.