Networking.pdf
- 1. MASTER OF INFORMATION TECHNOLOGY UNIVERSITY OF COLOMBO SCHOOL OF COMPUTING Address Resolution Protocol (ARP) MIT 2201 Computer Networking Dr. Ajantha Atukorale aja@ucsc.cmb.ac.lk
- 2. Overview
- 3. Overview • The delivery of a packet to a host or a router requires two levels of addressing: logical and physical. • We need to be able to map a logical address to its corresponding physical address and vice versa. • These can be done using either static or dynamic mapping.
- 4. Address Resolution Protocol (ARP) • Each device on a network maintains its own ARP table. • A device that requires an IP and MAC address pair broadcasts an ARP request. • If one of the local devices matches the IP address of the request, it sends back an ARP reply that contains its IP-MAC pair. • If the request is for a different IP network, a router performs a proxy ARP. • The router sends an ARP response with the MAC address of the interface on which the request was received, to the requesting host.
- 5. Address Translation with ARP ARP Request: Argon broadcasts an ARP request to all stations on the network: “What is the hardware address of Router137?”
- 6. Address Translation with ARP ARP Reply: Router 137 responds with an ARP Reply (unicast) which contains the hardware address
- 7. Address Translation with ARP
- 8. Address Translation with ARP LAN a. ARP request is multicast System A System B b. ARP reply is unicast LAN System A System B Looking for physical address of a node with IP address 141.23.56.23 Request The node physical address is A4:6E:F4:59:83:AB Reply
- 9. • Sender knows the IP address of the target. • IP asks ARP to create ARP request message. It includes sender’s and target’s IP and physical addresses. Target Physical address is all 0s. • Message is passed to data link layer, encapsulated in a frame using sender’s physical address. The physical destination address is the broadcast address. • All machines drop the packet except the targeted machine. Target machine identifies the IP address. • Target machine sends the ARP reply with its physical address. • Sender receives the reply and knows the physical address of target. • IP datagram, carries data for target machine, is now encapsulated in a frame and is unicast to the destination. Delivery of the Datagram
- 10. • Hardware Type: 16-bits; Defining the type of network; Ethernet is 1. • Protocol Type: 16-bits; IPv4 is 0800. • Hardware and Protocol length is 8-bits. ARP Packet Format
- 11. Encapsulation of ARP Packet Start of Frame Delimiter -SFD
- 12. Encapsulation of ARP Packet An ARP request is broadcast; an ARP reply is unicast.
- 13. Example 1 • A host with IP address 130.23.43.20 and physical address B2:34:55:10:22:10 has a packet to send to another host with IP address 130.23.43.25 and physical address A4:6E:F4:59:83:AB. • The two hosts are on the same Ethernet network. Show the ARP request and reply packets encapsulated in Ethernet frames.
- 14. Example 1
- 15. ARP Cache Timeout • Since sending an ARP request/reply for each IP datagram is inefficient, hosts maintain a cache (ARP Cache) of current entries. The entries expire after ARP cache timeout. • Older versions of Windows used to have a timeout of 2 minutes for ARP entries. • This has changed in Vista and Server 2008 onwards to comply with RFC4861. The new implementation has lowered this time to a random value between 15 seconds and 45 seconds. • Commands to check: C:> netsh interface ipv4 show interface <interface ID> $ cat /proc/sys/net/ipv4/neigh/default/gc_stale_time
- 16. Four cases using ARP
- 17. Proxy ARP Proxy ARP: Host or router responds to ARP Request that arrives from one of its connected networks for a host that is on another of its connected networks. 128.143.137.1/16 00:e0:f9:23:a8:20 128.143.71.1/24 128.143.0.0/16 Subnet 128.143.71.0/24 Subnet Router137 ARP Request: W hat is the MAC address of 128.143.71.21? 128.143.137.144/16 128.143.171.21/24 00:20:af:03:98:28 Argon Neon ARP Reply: The MAC address of 128.143.71.21 is 00:e0:f9:23:a8:20 128.143.71.21/24
- 18. Things to know about ARP • What happens if an ARP Request is made for a non-existing host? Several ARP requests are made with increasing time intervals between requests. Eventually, ARP gives up. • On some systems (including Linux) a host periodically sends ARP Requests for all addresses listed in the ARP cache. This refreshes the ARP cache content, but also introduces traffic.
- 19. Vulnerabilities of ARP • Since ARP does not authenticate requests or replies, ARP Requests and Replies can be forged • ARP is stateless: ARP Replies can be sent without a corresponding ARP Request • According to the ARP protocol specification, a node receiving an ARP packet (Request or Reply) must update its local ARP cache with the information in the source fields, if the receiving node already has an entry for the IP address of the source in its ARP cache. (This applies for ARP Request packets and for ARP Reply packets)
- 20. Vulnerabilities of ARP Typical exploitation of these vulnerabilities: • A forged ARP Request or Reply can be used to update the ARP cache of a remote system with a forged entry (ARP Poisoning) • This can be used to redirect IP traffic to other hosts • Generally, the aim is to associate the attacker's MAC address with the IP address of another host (such as the default gateway), causing any traffic meant for that IP address to be sent to the attacker instead. • ARP spoofing may allow an attacker to intercept data frames on a LAN, modify the traffic, or stop the traffic altogether.
- 21. ARP Spoofing/poisoning • Simplicity also leads to major insecurity • No Authentication • ARP provides no way to verify that the responding device is really who it says it is • Stateless protocol • Updating ARP Cache table • Attacks • DOS • Hacker can easily associate an operationally significant IP address to a false MAC address • Man-in-the-Middle • Intercept network traffic between two devices in your network
- 22. Ethernet: 0800.0020.1111 IP = ??? What is my IP address? Reverse ARP
- 23. Ethernet: 0800.0020.1111 IP: 172.16.3.25 Ethernet: 0800.0020.1111 IP = ??? What is my IP address? I heard that broadcast. Your IP address is 172.16.3.25. Maps: MAC IP Reverse ARP
- 24. • RARP (Reverse Address Resolution Protocol) is a protocol by which a physical machine in a local area network can request to learn its IP address from a gateway. • A network administrator creates a table in a local area network's gateway router that maps the physical machine (MAC address) addresses to corresponding Internet Protocol addresses. • When a new machine is set up, its RARP client program requests from the RARP server on the router to be sent its IP address. • Assuming that an entry has been set up in the router table, the RARP server will return the IP address to the machine which can store it for future use. • RARP is available for Ethernet, Fiber Distributed-Data Interface, and token ring LANs. Reverse ARP
- 25. Home Work
- 26. End of Lecture Any Questions?