Understanding Arp; Understanding Arp Spoofing Attacks; Understanding Dai And Arp Spoofing Attacks - Cisco 7604 Configuration Manual

Understanding DAI

Understanding ARP

ARP provides IP communication within a Layer 2 broadcast domain by mapping an IP address to a MAC
address. For example, Host B wants to send information to Host A but does not have the MAC address
of Host A in its ARP cache. Host B generates a broadcast message for all hosts within the broadcast
domain to obtain the MAC address associated with the IP address of Host A. All hosts within the
broadcast domain receive the ARP request, and Host A responds with its MAC address.

Understanding ARP Spoofing Attacks

ARP spoofing attacks and ARP cache poisoning can occur because ARP allows a gratuitous reply from
a host even if an ARP request was not received. After the attack, all traffic from the device under attack
flows through the attacker's computer and then to the router, switch, or host.
An ARP spoofing attack can target hosts, switches, and routers connected to your Layer 2 network by
poisoning the ARP caches of systems connected to the subnet and by intercepting traffic intended for
other hosts on the subnet.
Figure 38-1 ARP Cache Poisoning
Host A
(IA, MA)
Hosts A, B, and C are connected to the router on interfaces A, B and C, all of which are on the same
subnet. Their IP and MAC addresses are shown in parentheses; for example, Host A uses IP address IA
and MAC address MA. When Host A needs to communicate to Host B at the IP layer, it broadcasts an
ARP request for the MAC address associated with IP address IB. When the router and Host B receive
the ARP request, they populate their ARP caches with an ARP binding for a host with the IP address IA
and a MAC address MA; for example, IP address IA is bound to MAC address MA. When Host B
responds, the router and Host A populate their ARP caches with a binding for a host with the IP address
IB and the MAC address MB.
Host C can poison the ARP caches of the router, Host A, and Host B by broadcasting forged ARP
responses with bindings for a host with an IP address of IA (or IB) and a MAC address of MC. Hosts
with poisoned ARP caches use the MAC address MC as the destination MAC address for traffic intended
for IA or IB. This means that Host C intercepts that traffic. Because Host C knows the true MAC
addresses associated with IA and IB, it can forward the intercepted traffic to those hosts by using the
correct MAC address as the destination. Host C has inserted itself into the traffic stream from Host A to
Host B, which is the topology of the classic man-in-the middle attack.

Understanding DAI and ARP Spoofing Attacks

DAI is a security feature that validates ARP packets in a network. DAI intercepts, logs, and discards ARP
packets with invalid IP-to-MAC address bindings. This capability protects the network from some
man-in-the-middle attacks.
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
38-2
Figure 38-1 shows an example of ARP cache poisoning.
A B
C
Host C (man-in-the-middle)
(IC, MC)
Chapter 38 Configuring Dynamic ARP Inspection
Host B
(IB, MB)
OL-4266-08