
50 ◾ Network Attacks and Defenses: A Hands-on Approach
Table3.2 List of Possible Abnormal ARP Reply Packets (Continued)
Packet Identifier P#5 P#6 P#7 P#8
P#9
(Broadcast
ARP reply)
P#10 (Unexpected
IP or MAC address)
ARP Header
Destination MAC MAC address
of a
non existent
host
MAC
address of a
host B
00-00-00-00-00-00
ff-ff-ff-ff-ff-ff
Multicast
Ethernet Header
Source MAC MAC
address of a
nonexistent
host
00-00-00-00-00-00
ff-ff-ff-ff-ff-ff
Multicast
Destination MAC MAC
address of a
nonexistent
host
ff-ff-ff-ff-ff-ff 00-00-00-00-00-00
ff-ff-ff-ff-ff-ff
Multicast
Does the packet corrupt
the ARP cache?
Yes No No No No No