Arp cheating and anti-cheating

ARP (Address Resolution Protocol) is a network layer located in the TCP/IP protocol stack, responsible for resolving an IP address into a corresponding MAC address.

The basic function of ARP protocol is to query the MAC address of the target device through the IP address of the target device to ensure communication.

Limitations of ARP***:

ARP*** can only be performed in Ethernet (local area network such as computer room, intranet, company network, etc.); it cannot be performed in external network (Internet, local area network outside this area).

ARP spoofing is achieved by forging IP addresses and MAC addresses, which can generate a large amount of ARP traffic in the network to block the network. As long as the ARP spoofing continues to issue forged ARP response packets, the ARP spoofing can change the IP-MAC entries in the ARP cache of the target host, causing network interruption or middleman.

Key commands:

arpspoof -i eth0 -t 172.28.15.31 172.28.15.254

echo 1 > /proc/sys/net/ipv4/ip_forward

driftnet

arpspoof -i eth0 -t 172.28.15.254 172.28.15.31

2 ARP Anti-Deception

Method 1: Deploy a dedicated ARP*** protection system to detect ARP** launching computers and counter ARP*** behavior

Method 2: The local area network computer gateway static binding, which can effectively prevent ARP off the network ***. (Primary learning method)