Mitigating Arp Spoofing Attacks Using Packet Content Acl; Appendix A - D-Link xStack DGS-3400 Series Reference Manual

x Stack

Appendix A

Mitigating ARP Spoofing Attacks Using Packet Content ACL

How Address Resolution Protocol works
Address Resolution Protocol (ARP) is the standard method for finding a host's hardware address (MAC address) when only its IP
address is known. However, this protocol is vulnerable because crackers can spoof the IP and MAC information in the ARP
packets to attack a LAN (known as ARP spoofing). This document is intended to introduce the ARP protocol, ARP spoofing
attacks, and the countermeasures brought by D-Link's switches to thwart ARP spoofing attacks.
In the process of ARP, PC A will first issue an ARP request to query PC B's MAC address. The network structure is shown in
Figure 1.
Figure 1
00-20-5C-01-33-33
10.10.10.3
00-20-5C-01-44-44
10.10.10.4
In the meantime, PC A's MAC address will be written into the "Sender H/W Address" and its IP address will be written into the
"Sender Protocol Address" in the ARP payload. As PC B's MAC address is unknown, the "Target H/W Address" will be "00-00-
00-00-00-00," while PC B's IP address will be written into the "Target Protocol Address," shown in Table1.
Table 1. ARP Payload
H/W Protocol H/W
Type Type Address
Length
The ARP request will be encapsulated into an Ethernet frame and sent out. As can be seen in Table 2, the "Source Address" in the
Ethernet frame will be PC A's MAC address. Since an ARP request is sent via broadcast, the "Destination address" is in a format
of Ethernet broadcast (FF-FF-FF-FF-FF-FF).
Table 2. Ethernet Frame Format
Destination Address
FF-FF-FF-FF-FF-FF
When the switch receives the frame, it will check the "Source Address" in the Ethernet frame's header. If the address is not in its
Forwarding Table, the switch will learn PC A's MAC and the associated port into its Forwarding Table.
Forwarding Table
Port 1 00-20-5C-01-11-11
In addition, when the switch receives the broadcasted ARP request, it will flood the frame to all ports except the source port, port
1 (see Figure 2).
®
DGS-3400 Series Layer 2 Gigabit Ethernet M anaged Sw itch
C
Port 3
Port 4
D
Protocol Operation
Address
Length
ARP request
Source Address
00-20-5C-01-11-11
Who is 10.10.10.2?
Port 1 00-20-5C-01-11-11
10.10.10.1
Port 2
00-20-5C-01-22-22
10.10.10.2
Sender Sender
H/W Address Protocol
Address
00-20-5C-01-11-11 10.10.10.1
Ether-Type ARP
411
A
Sender
B
Target
Target
H/W Address
00-00-00-00-00-00
FCS
Target
Protocol
Address
10.10.10.2