Address Resolution Protocol (ARP) Spoofing

[LEE]

There are Ip resolving protocol used. ARP is basically used for map IP addressing to the MAC addresses with in a local area network segment where hosts of the same subnet reside. Normally, a host sends out a broadcast ARP request to find the MAC address of another host with a particular IP address, and an ARP response comes from the host whose address matches the request. The requesting host then caches this ARP response. Within the ARP protocol, another provision is made for hosts to perform unsolicited ARP replies. The unsolicited ARP replies are called Gratuitous ARP (GARP).

[rocky123]

Where as thee Gratuitous ARP (GARP) can be exploited the maliciously by an attacker to spoof the identity by an IP address on the LAN segment of the network. This is typically used to spoof the identity between two hosts or all traffic to and from a default gateway in a "man-in-the-middle" attack.

[williams_k]

The ARP reply causes the sender to store the MAC address of the network attacker's system in the ARP cache. When the ARP reply is being crafted, the network attacker can show/make his or her system appear to be the destination host sought by the sender. This MAC address is also stored by the switch in its CAM table. In this way, the network attacker has inserted the MAC address of his or her system into both the switch CAM table and the ARP cache of the sender. This allows the network attacker to intercept frames destined for the host that he or she is spoofing.