SimulatorUnit 3 Primer
ARP: ask for a MAC address, then poison the cache
Watch ARP find a MAC address, then see an adversary poison the cache.
New to this? Read the topic first: Primer: Addresses.
Simulation · ARP poisoning [3.1.A.1, 3.5.E.3]
Simulator: poison the gateway's ARP table
You play both sides. First watch normal delivery, then attack as the adversary, then defend by spotting the indicator.
| Protocol | Address | Age (min) | Hardware Addr | Type | Interface |
|---|---|---|---|---|---|
| Internet | 192.168.1.1 | - | 001a.2b3c.4d5e | ARPA | Gi0/1 |
| Internet | 192.168.1.10 | 3 | 3c52.824a.9f10 | ARPA | Gi0/1 |
| Internet | 192.168.1.66 | 1 | 660b.5de2.21ad | ARPA | Gi0/1 |
Cisco routers write a MAC address in three groups of four: 3c52.824a.9f10 is 3C:52:82:4A:9F:10. Age: minutes since the entry was learned; - is the router's own address.
| No. | Time | Source | Destination | Protocol | Info |
|---|---|---|---|---|---|
| 1 | 0.000000 | 00:1a:2b:3c:4d:5e | Broadcast | ARP | Who has 192.168.1.10? Tell 192.168.1.1 |
| 2 | 0.001842 | 3c:52:82:4a:9f:10 | 00:1a:2b:3c:4d:5e | ARP | 192.168.1.10 is at 3c:52:82:4a:9f:10 |
| 3 | 4.120375 | 66:0b:5d:e2:21:ad | 00:1a:2b:3c:4d:5e | ARP | 192.168.1.10 is at 66:0b:5d:e2:21:ad |
| 4 | 6.121004 | 66:0b:5d:e2:21:ad | 00:1a:2b:3c:4d:5e | ARP | 192.168.1.10 is at 66:0b:5d:e2:21:ad |
| Capturing... no ARP frames yet. | |||||
Frames 1 and 2: the gateway asks, the target answers. Frames 3 and 4: replies nobody asked for, sent again every 2 seconds to keep the table poisoned.
Read the steps without the simulator
- Normal delivery. A web page for 192.168.1.10 arrives at the default gateway. The gateway asks "Who has 192.168.1.10?" and the target replies with 3C:52:82:4A:9F:10 (frames 1 and 2). The gateway sends the frame straight to the target.
- The attack. The adversary at 192.168.1.66 sends the gateway falsified ARP replies saying "192.168.1.10 is at 66:0B:5D:E2:21:AD" (frames 3 and 4). Nobody asked, and ARP cannot verify replies, so the gateway updates its table.
- On the path. Traffic for 192.168.1.10 now goes to the adversary's MAC address first. The adversary copies or alters it, then forwards it to the target, so neither side notices: an on-path attack.
- Detection. The table now lists 66:0B:5D:E2:21:AD (660b.5de2.21ad) for both 192.168.1.10 and 192.168.1.66. One MAC address for two IP addresses is the warning sign of ARP poisoning.
| After the attack: Address | Hardware Addr |
|---|---|
| 192.168.1.10 | 660b.5de2.21ad |
| 192.168.1.66 | 660b.5de2.21ad |