In such a situation, is it an ARP virus?

It's not an ARP virus, it's unlikely that ARP is in diskless Internet cafes, and it's not the phenomenon you're talking about. Slow startup could be something else.

The principle of ARP spoofing.

The ARP spoofing used by cyber enforcers makes it impossible for an attacked computer to access the Internet by preventing the computer from finding the MAC address of the gateway. So what's all about ARP spoofing? Knowing what it is, knowing why it is is our fine tradition of Hacker X Files, let's talk about this below.

First of all, let's talk about what arp is, arp (address

resolution

Protocol) is an address resolution protocol, which is a protocol that converts IP addresses into physical addresses. There are two ways to map from an IP address to a physical address: a non-one.

Specifically, ARP parses the address of the network layer (IP layer, which is equivalent to the third layer of OSI) to the MAC address of the data connection layer (MAC layer, which is equivalent to the second layer of OSI).

ARP principle: If machine A wants to send packets to host B, it queries the local ARP cache table, finds the MAC address corresponding to B's IP address, and transmits data. If it is not found, an ARP request packet (carrying the IP address of host A is -- the physical address PA) is broadcast, and the request IP address is the physical address PB of host B of IB.

All hosts on the network, including B, receive ARP requests, but only host B recognizes its IP address and sends an ARP response packet to host A. It contains the MAC address of B, and after A receives B's reply, it will update the local ARP cache. This MAC address is then used to send data (the MAC address is attached by the network card).

Therefore, the ARP table of the local cache is the basis of local network circulation, and the cache is dynamic.

The ARP protocol does not receive an ARP reply only when an ARP request is sent. When the computer receives the ARP reply packet, it will update the local ARP cache and store the IP and MAC addresses in the ARP cache. Therefore, if B sends a forged ARP reply from B to A, and if the reply is forged by B impersonating C, that is, the IP address is the IP of C, and the MAC address is forged, then when A receives the forged ARP reply from B, it will update the local ARP cache, so that A's IP address has not changed, and its MAC address is no longer the original one.

Since the network circulation of the LAN is not based on the IP address, but according to the MAC address. Therefore, the forged MAC address is changed to a non-existent MAC address on A, which will cause the network to be unreachable, resulting in A not being able to ping C! That's a simple ARP spoof.

That's how cyber enforcement officers take advantage of it! Knowing how it works, it's much easier to break through its defenses.

The main symptoms at the time of ARP attack:

1. Frequent loss of online banking, games and QQ.

In order to obtain illegal benefits, some people use ARP spoofing programs to carry out illegal activities in the network, and the main purpose of such programs is to crack the encryption and decryption algorithm at the time of login, by intercepting the data packets in the local area network, and then intercepting the user's information by analyzing the data communication protocol. By running this type of Trojan virus, you can obtain and steal the details of Internet users in the entire local area network.

2. The network speed is sometimes fast and slow, and it is extremely unstable, but everything is normal when the single machine is tested for optical fiber data, and after a computer in the domain is illegally invaded by the ARP deception program, it will continue to send a large number of illegal ARP deception data packets to all computers and network equipment in the network, blocking the network channel, causing the network equipment to be overloaded, resulting in unstable communication quality of the network.

3. Frequent regional or overall disconnection in the local area network, restart the computer or network equipment to return to normal when the computer with ARP deception program communicates in the network, it will lead to frequent drops, restarting the computer or disabling the network card after such problems will temporarily solve the problem, but the drop will still occur.

Wish!!