DGS-3700 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
Page | 550
A
PPENDIX
S
ECTION
13
Table of Contents
Previous Section
A
PPENDIX
A
Back to Section Header
M
ITIGATING
ARP
S
POOFING
A
TTACKS
U
SING
P
ACKET
C
ONTENT
ACL
H
OW
A
DDRESS
R
ESOLUTION
P
ROTOCOL WORKS
Address Resolution Protocol (ARP) is the standard
method for finding a host’s hardware address (MAC
address) when only its IP address is known.
However, this protocol is vulnerable because
crackers can spoof the IP and MAC information in
the ARP packets to attack a LAN (known as ARP
spoofing). This document is intended to introduce
the ARP protocol, ARP spoofing attacks, and the
countermeasures brought by D-Link’s switches to
thwart ARP spoofing attacks.
In the process of ARP, PC A will first issue an ARP
request to query PC B’s MAC address. The network
structure is shown in Figure 1.
In the meantime, PC A’s MAC address will be
written into the “Sender H/W Address” and its IP
address will be written into the “Sender Protocol
Address” in the ARP payload. As PC B’s MAC
address is unknown, the “Target H/W Address” will
be “00-00-00-00-00-00,” while PC B’s IP address
will be written into the “Target Protocol Address,”
shown in Table1.
Figure 1
H/W Type
Protocol Type
H/W Address
Length
Protocol
Address
Length
Operation
Sender
H/W Address
Sender Protocol
Address
Target
H/W Address
Target Protocol
Address
ARP request
00-20-5C-01-11-11
10.10.10.1
00-00-00-00-00-00
10.10.10.2
Table 1. ARP Payload
The ARP request will be encapsulated into an Ethernet frame and sent out. As can be seen in Table 2, the
“Source Address” in the Ethernet frame will be PC A’s MAC address. Since an ARP request is sent via
broadcast, the “Destination address” is in a format of Ethernet broadcast (FF-FF-FF-FF-FF-FF).
Destination Address
FF-FF-FF-FF-FF-FF
Source Address
00-20-5C-01-11-11
Ether-Type
ARP
FCS
Table 2. Ethernet Frame Format
When the switch receives the frame, it will check the “Source Address” in the Ethernet frame’s header. If the
address is not in its Forwarding Table, the switch will learn PC A’s MAC and the associated port into its
Forwarding Table.
