ARP and ARP Spoofing

---

Preface

When a network device has data to send to another network device , You have to know the other person's Network layer address （IP Address ）.IP The address is provided by the network layer , But only IP The address is not enough ,IP The data packet It must be encapsulated into frames to be sent through the data link layer . The data frame should contain the purpose MAC Address , Therefore, the sender must also obtain the purpose MAC Address .

Through purpose IP Get the purpose MAC The process of address is controlled by ARP Protocol to implement .

---

One 、ARP What is it? ？

Address resolution protocol ,Address Resolution Protocol

host A To send a packet to the host C, Host computer A ping host C 10.0.0.3, Data is encapsulated from the upper layer , Active when reaching the network layer IP And purpose IP（ May by DNS obtain ）, To the data link layer , To encapsulate the source MAC And purpose MAC, Purpose MAC Unknown . that , You need to send ARP.

Two 、ARP Detailed explanation

1.ARP request

Data is encapsulated into the link layer , Found no MAC Address , Instead, encapsulate a ARP request . But it still needs one to encapsulate into frames MAC Address , Write the destination at the head of the frame MAC：FF-FF-FF-FF-FF-FF, Broadcast address , stay ARP There is a purpose in the data IP Field . Every network device receives this ARP Request package , Can extract ARP data , Match to host IP And packet purpose IP Agreement , Return the... Of the host MAC Address .

2.ARP Respond to

host C Received by the host A It's on the air ARP request , Purpose of discovery IP Consistent with this host , Returns a ARP Response packets .

3.ARP Packet format

ARP Broadcast can only be in the same network segment , Each interface of the router must be in different network segments , therefore ARP The message cannot pass through the router .

In the configuration IP Address time , The network device will send a free ARP, Used to ensure that no IP Address conflict

In some special cases , have access to ARP agent , Realize different network segments ARP Request

ARP cheating

ARP cheating ： The attacker sent “ Without any reason ARP Respond to ” To disguise other devices , Cause communication failure