Scribd
Upload
89 views

Key Attributes: ARP Frame Format

This document provides an overview of the Address Resolution Protocol (ARP) including: - ARP is a layer 2 protocol that maps IP addresses to MAC addresses. - It uses ARP request and reply frames to discover MAC addresses associated with IP addresses. - ARP is vulnerable to spoofing attacks if it is not secured properly. Common attacks include ARP poisoning and man-in-the-middle attacks. - ARP security features like DHCP snooping, dynamic ARP inspection, and port security can help mitigate spoofing threats.

Uploaded by

tom tailor
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
89 views

Key Attributes: ARP Frame Format

This document provides an overview of the Address Resolution Protocol (ARP) including: - ARP is a layer 2 protocol that maps IP addresses to MAC addresses. - It uses ARP request and reply frames to discover MAC addresses associated with IP addresses. - ARP is vulnerable to spoofing attacks if it is not secured properly. Common attacks include ARP poisoning and man-in-the-middle attacks. - ARP security features like DHCP snooping, dynamic ARP inspection, and port security can help mitigate spoofing threats.

Uploaded by

tom tailor
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

ARP (Address Resolution Protocol) – Cheat Sheet – Part-1 v1 Version 2

Key Attributes
Protocol Type: Layer2 (Data Link Layer) IP Address (32-bit)
Purpose: Physical to Logical Address mapping (IP to MAC)
Standard: RFC826 (1982)
Founder: David C. Plummer RARP
ARP
“ARP is a Layer-2 Protocol used for discovering MAC from IP Address”
MAC Address (48-bit)

ARP Request ARP Reply

PC1 PC2 PC3 Server4 PC1 PC2 PC3 Server4


10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4 10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4

ARP Frame Format ARP Types


ARP IP to MAC mapping
Inverse ARP MAC to IP mapping www.networkwalks.com
A security feature in which a proxy device on the network answers the ARP queries
Proxy ARP for an IP address that is not on that network
ARP request issued by an IP address and addressed to the same IP address to confirm
Gratuitous ARP duplicate IP on the subnet
Serial Line ARP (SLARP) ARP request used for serial interfaces that use HDLC encapsulation
Mapping MAC to IP for someone else.
Reverse ARP RARP is obsolete now. It was replaced by BOOTP & later by DHCP.

ARP Security Threats ARP Security Mitigations


ARP does not provide methods for authenticating ARP replies on a network. Therefore, a forged ARP Request or Reply ✓ Use DAI (Dynamic ARP Inspection) to prevent ARP Poisoning Attacks
from a local attacker can be used to update the ARP cache of a remote system with a forged entry (ARP Poisoning)
which is used to redirect IP traffic to other hosts. Some common types of Attacks include: ✓ Use the DHCP Snooping Database with other techniques to secure ARP
▪ ARP Spoofing Attacks: Attacker sends forged ARP frames & ARP replies & maps ✓ Use Packet filters that do not allow Packets with conflicting info (e.g. packets that come
Victim’s IP with Attacker’s MAC (e.g. Ettercap Tool) from outside but have an inside source IP)
▪ ARP Poisoning Attacks: After ARP Spoofing, the attacker poisons the victim's ARP table ✓ Implement Strict Admission Control Policies
& creates forged MAC-to-IP mappings ✓ Implement Port Security. Do not allow any device to connect without Authentication
www.networkwalks.com

▪ DoS Attacks: After ARP Spoofing, attacker is able to perform DoS Attacks ✓ Use ARP spoofing detection software which inspect and certify data before it is
transmitted and block the data that appears to be spoofed
▪ MiTM (Sniffing) Attacks: After ARP Spoofing, attacker is able to perform MiTM Attacks
✓ Use cryptographic network protocols like TLS, SSH, HTTPS and other secure
▪ Session Hijacking Attacks: After ARP Spoofing, attacker is able to perform Session communications protocols to prevent ARP spoofing attack by encrypting data prior to
Hijacking Attacks transmission and authenticating data when it is received

ARP Commands (Cisco)


ARP feature is enabled on all vendor equipment by default and is set to use Ethernet encapsulation
usually but we can create static ARP entries as well as in below:
R1(config)# arp 10.0.0.0 aabb.cc03.8200 arpa
R1# clear arp-cache R1# show ip arp

New batch of online Cisco CCNA 200-301 is starting!


Enrol today with us for quality training: [email protected]

/Network Walks /NetworkWalks /company/networkwalks


Visit our website & You Channel for more FREE resources like Cheatsheets,
Workbooks, Labs, Interview Questions, Quiz, VCE exams

Network Walks Training Academy www.networkwalks.com


Your Feedback, Comments are always Welcomed: [email protected]

You might also like