flâneur

ARP | Computer Security

textbook.cs161.org · 662 words · saved by 1 readers

Recall that on a LAN (local-area network), all machines are connected to all other machines. Ethernet is one particular LAN implementation that uses wires to connect all machines. Ethernet started as a broadcast-only network. Each node on the network could see messages sent by all other nodes, either by being on a common wire or a network hub, a simple repeater that took every packet it received and rebroadcast it to all the outputs. A receiver is simply supposed to ignore all packets not sent to either the receiver’s MAC or the broadcast address. But this is only enforced in software, and most Ethernet devices can enter promiscuous mode, where it will receive all packets. This is also called sniffing packets. For versions of Ethernet that are inherently broadcast, such as a hub, an adversary in the local network can see all network traffic and can also introduce any traffic they desire by simply sending packets with a spoofed MAC address. Sanity check: what type of adversary does this

26. Wired Local Networks: ARP 26.1. Cheat sheet Layer: Link (2) Purpose: Translate IP addresses to MAC addresses Vulnerability: On-path attackers can see requests and send spoofed malicious responses Defense: Switches, arpwatch 26.2. Networking background: Ethernet Recall that on a LAN (local-area network), all machines are connected to all other machines. Ethernet is one particular LAN implementation that uses wires to connect all machines. Ethernet started as a broadcast-only network. Each node on the network could see messages sent by all other nodes, either by being on a common…

saved by

related reading