Appendix A Mitigating Arp Spoofing Attacks Using Packet Content Acl - D-Link DWS-3160-24TC Cli Reference Manual

DWS-3160 Series Gigabit Ethernet Unified Switch CLI Reference Guide
Appendix A
How Address Resolution Protocol works
Address Resolution Protocol (ARP) is the standard method for finding a host's hardware address
(MAC address) when only its IP address is known. However, this protocol is vulnerable because
crackers can spoof the IP and MAC information in the ARP packets to attack a LAN (known as
ARP spoofing). This document is intended to introduce the ARP protocol, ARP spoofing attacks,
and the countermeasures brought by D-Link's switches to thwart ARP spoofing attacks.
In the process of ARP, PC A will first issue an ARP request to query PC B's MAC address. The
network structure is displayed in Figure 1.
In the meantime, PC A's MAC address will be written into the "Sender H/W Address" and its IP
address will be written into the "Sender Protocol Address" in the ARP payload. As PC B's MAC
address is unknown, the "Target H/W Address" will be "00-00-00-00-00-00," while PC B's IP
address will be written into the "Target Protocol Address," displayed in Table1.
Mitigating ARP Spoofing
Attacks Using Packet
Content ACL
Figure 1
937