What is the viral manifestation of ARP

There are two types of ARP spoofing, one is the spoofing of the router's ARP table; The other is gateway spoofing for intranet PCs. 360 Security Guard comes with an ARP firewall and can be used.

The principle of ARP spoofing.

The ARP spoofing used by cyber enforcers makes it impossible for an attacked computer to access the Internet by preventing the computer from finding the MAC address of the gateway. So what's all about ARP spoofing? Knowing what it is, knowing why it is is our fine tradition of Hacker X Files, let's talk about this below.

First of all, let's talk about what arp is, arp (address

resolution

Protocol) is an address resolution protocol, which is a protocol that converts IP addresses into physical addresses. There are two ways to map from an IP address to a physical address: a non-one.

Specifically, ARP parses the address of the network layer (IP layer, which is equivalent to the third layer of OSI) to the MAC address of the data connection layer (MAC layer, which is equivalent to the second layer of OSI).

ARP principle: If machine A wants to send packets to host B, it queries the local ARP cache table, finds the MAC address corresponding to B's IP address, and transmits data. If it is not found, an ARP request packet (carrying the IP address of host A is -- the physical address PA) is broadcast, and the request IP address is the physical address PB of host B of IB.

All hosts on the network, including B, receive ARP requests, but only host B recognizes its IP address and sends an ARP response packet to host A. It contains the MAC address of B, and after A receives B's reply, it will update the local ARP cache. This MAC address is then used to send data (the MAC address is attached by the network card).

Therefore, the ARP table of the local cache is the basis of local network circulation, and the cache is dynamic.

The ARP protocol does not receive an ARP reply only when an ARP request is sent. When the computer receives the ARP reply packet, it will update the local ARP cache and store the IP and MAC addresses in the ARP cache. Therefore, if B sends a forged ARP reply from B to A, and if the reply is forged by B impersonating C, that is, the IP address is the IP of C, and the MAC address is forged, then when A receives the forged ARP reply from B, it will update the local ARP cache, so that A's IP address has not changed, and its MAC address is no longer the original one.

Since the network circulation of the LAN is not based on the IP address, but according to the MAC address. Therefore, the forged MAC address is changed to a non-existent MAC address on A, which will cause the network to be unreachable, resulting in A not being able to ping C! That's a simple ARP spoof.

That's how cyber enforcement officers take advantage of it! Knowing how it works, it's much easier to break through its defenses.