When two hosts want to communicate to each other through an Ethernet link, the source host must know the MAC address of the destination host. In this way, the source host looks at its ARP table to see if there is a MAC address corresponding to the destination host IP address. If not, it broadcasts an ARP Request to the entire network asking “arp who-has dst_host tell src_host”.
All the hosts on the network ignore the ARP Request except the destination host, which in turn sends an ARP Reply telling “arp reply dst_host is at aa:bb:cc:dd:ee:ff”.
As you can see ARP is a simple and efficient protocol that basically consists of an ARP request and an ARP reply (OK OK, there are also RARP request (Reverse ARP) and RARP reply). This simplicity leads to some security issues due to the fact that ARP does not implement authentication mechanisms.
ARP does not verify replies, so bad guys can force an ARP cache poisoning. This could lead to MAC flooding attacks, man in the middle attacks, etc…
Despite ARP cache poisoning is a relatively easy exploit and can result in a serious network compromise, there are some preventive measures:
- Bear in mind that attackers need access to your network, this technique can not be remotely exploited. So check and reinforce your firewalls.
- If you administer a small network, you can create and maintain an ethernet address to IP number database (/etc/ethers, man ethers).
- Install ARPwatch. Install IDS tools such as Snort.
- Common sense.
References:
