Hacking: The Next Generation

Abusing ARP

Address Resolution Protocol (ARP) is a way for machines to translate IP addresses into Media Access Control (MAC) addresses. MAC addresses are link layer addresses assigned by the network device manufacturer. These addresses are static, meaning they never change. Due to the dynamic nature of IP addresses, ARP allows a way to correlate these static addresses to their more dynamic counterparts.

Think of ARP as a phone operator. If a person knows an individual’s name but not her phone number, he can contact the phone operator who aids him by giving him the individual’s phone number. This is similar to the way that ARP works.

When a computer, router, or switch receives a packet that has an IP address associated with it, the device will do an ARP lookup in its ARP tables to see what MAC address is bound to that IP address.

Back to the operator analogy: before people call an operator for assistance, they check their personal address book to see whether they already have the individual’s phone number. Similarly, if the packet’s IP address does not correspond to an IP address that is in the ARP table, the machine will send out an ARP broadcast request that essentially asks all the computers on the local network, “Who is bound to this IP address?”

In this situation, the machine that owns the IP address will respond to the broadcast request. This response is called an ARP reply. Once the machine that sent the ARP request receives the response, the ARP-to-IP address translation is ...