linux-Understanding ARP, gateway, routing

Suppose you call a little (local host), live in a large yard (local area network), there are many neighbors (Internet neighbors), the door of the front of the door to see the big Uncle Li, Li is your gateway. When you want to play with a partner in the yard, as long as you shout his name in the yard (ping him), he will respond to you when he hears it and run out to play with you.

But you are not allowed to walk out of the door, you and the outside world all contact, must master Li (Gateway) to help you contact. If you want to talk to your classmate Xiao Ming, Xiao Ming lives in a very far away from the other yard (Xiaoming and you are not a local area network), his home yard also has a janitor Wang uncle (Xiao Ming's Gateway). You do not know the telephone number of Xiao Ming's home, but your teacher in charge has a list of all the classmates in your class and telephone numbers, your teacher is your DNS server. So you at home to dial the door Li uncle's phone, with the following dialogue:

Little: Uncle Li, I would like to find a teacher in charge of Xiao Ming's telephone number line? (DNS query)

Uncle Li: Ok, you wait. (then the master Li to your teacher hung a telephone, asked clearly Xiao Ming's telephone) asked, his family's number is 211.99.99.99 (Xiao Ming's home IP address)

Tiny: Great! Uncle Li, I want to find Xiao Ming, you can help me contact Xiao Ming.

Uncle Li: No problem. (then Mr. Li to the telephone office to send a request to connect Xiao Ming's home phone request, the last of course is transferred to Xiao Ming's home that yard Wang uncle there, and then Uncle Wang to turn the phone to Xiao Ming's Home) (route)

So you get in touch with Xiaoming. (Establish connection)

As for the DHCP server, it can be likened to:

The residents of your yard more and more, the front of the front of the telephone switch has been unable to meet the needs of so many residents (the original partner very few, with fixed IP), too much, can not control, the use of DHCP, the residents when the boot randomly get a phone number, each get the number may be different. Every once in a while, the number you rent will be withdrawn and the next time you need to get a new one. (This is the lease for DHCP)

Your door's big Uncle Li: Is your gateway

Your head teacher: That's your DNS server.

The phone switch in the front: your DHCP server

Ditto, the dialogue between Uncle Li and Wang Ye is called routing.

Another: If there is a child called the small dark, he lived in the yard of the janitor is sun, because the small dark yard just cover, Sun Uncle just came, he did not Li and Wang Uncle's office telephone (Li and Wang Ye of course did not his phone), then there will be two situations:

1, the neighborhood of Zhao Aunt told Sun Big Uncle about Li, Wang two uncle's telephone (at the same time Zhao Aunt also told Lee, Wang about Sun's phone), this is called static set routing

2, Zhao is sick, uncle Sun himself around the phone, see people said: "I was a small dark their yard tube phone", the result was Lee, Wang two heard, in their address book, and then Lee, Wang to the Sun master back a telephone said: "I am Xiao Ming (small) Their yard tube phone", this is called dynamic set routing

Then one day little to find small dark, the result is naturally tiny to Li uncle Call said: "Uncle, I find small dark" (here omitted to check the process of small dark phone, assuming he knew the small dark phone), Li uncle a Find Address book: "Oh, the small dark yard phone is Sun Uncle Guan, To find a small dark nature first notice, I can inform Wang uncle let him go to find sun uncle, also can himself directly to the sun, that is of course, he is directly to the sun convenient ", so uncle Li to Sun uncle called, and then sun Big Uncle again put the phone to the small dark home."

Here, Uncle Li's address book is called the routing table.

Mr. Li chose to be his own direct to the Sun master or let Wang Uncle help transfer called route selection.

Li Uncle chose to directly find Sun Uncle is based on, because he directly find Sun uncle can one step, if you want to Wang Uncle transfer will need two steps to complete, here "step" is called "Hop number", Uncle Li's choice follows is the minimum step (hop number) principle (if he does not abide by this principle, A little bit may be more time to find the small dark, the end result may be caused by the failure of Li's job was fired, which is called "delay too long, the principle of routing unreasonable, changed a router")

The route table on the Internet is always in this way, if one day the hub router is broken, then the end, many points associated with this will not find the target, you can not go to the net.

Of course, things are always changing, small and Xiao Ming quarrel, these days the little boy always give a phone, Xiao-Ming thought: ", he is not talking about my bad ah?" So Xiao Ming decided to eavesdrop on small and little dark calls, but he can not out of the yard, how to do? Xiaoming made such a decision:

First he told himself that the hospital phone king Uncle said: "You give Uncle Li Call said small dark moved to our yard, after all calls to his phone I come to pick up", Uncle Wang did not reflect (after all, old Ah!) He called Uncle Li, said: "Now I come to manage the small dark phone, sun has no matter", the results of his uncle Li's address book changed, this is called routing deception.

After small little again to find the dark, Lee Big Uncle to Wang (in fact should be transferred to the master), Wang Uncle received this call to Xiao Ming (because he had already and Xiaoming agreed), Xiao Ming received this phone pretend small dark and tiny communication. Because Xiao Ming Zuozeixinxu, afraid of Tomorrow little and small dark meet after the face to ask him, then the communication broke, and their own in the name of small little dark through a telephone repeated the words, there is this is called data * *.

Then, the little one is constantly and small dark contact, and scattered Xiao Ming, Xiao Ming's heart muttered AH: "I can not always so small dark identity and little talk Ah, outside a day out of what to do!" "So he thought of a more insidious trick:" I don't even listen to your phone, your little one not to call me! Then I'll let you give the little dark to play, hum! "And how did he do it?" Let's see:

He contacted a group of friends, and they colluded well, every day fixed a time everyone to the small dark yard to call the front, the content of everything, as long as the front of the sun grandfather answer the phone, you will hear "thunder, rain to accept clothes ah!" "," The person is the mother born, the demon is the demon his mother born "," Your mother's surname "and so on, listens to the head to be big, does not listen and not, the telephone keeps ringing! Finally one day, Grandpa Sun can't help, shouted: I can't stand pull!!!! "And hanged himself!"

This is the simplest DDoS attacks, Grandpa Sun's weak psychological ability to withstand the phenomenon is called "Data processing module has a bug", Grandpa Sun's suicide is called "router paralysis." If it were me, I would smile and small talk with them, for example, tell them "I have heard the weather forecast, the clothes have been collected 10 minutes ago" or "that your mother is a person or demon" or "with your grandmother a surname" and so on, I this sound psychology is called "robust datagram processing, can withstand any attack", even so, Xiao Ming find a bunch of friends (broiler), the same can let Uncle Sun hang off.

Sun grandfather collapsed, the little one finally no longer to small dark call, because no matter how he hit each other is a busy tone, this phenomenon is called "denial of service", so Xiaoming's practice also has a name called "Denial of Service attack" (Dos attack), more friends, called distributed denial of service attack (DDoS).

Xiao Ming finally quiet a few days, ...

A few days later, Xiao Ming's yard came a beautiful girl, named Small Li, Xiao-ming very much like her (little age to play what Puppy love!). But Xiao Li has a very handsome boyfriend, Xiao Ming despair no way. Of course, it is still to follow the above principle: Xiao Li is not allowed out of the yard. The man wants to soak up Xiao Li nature can only call, so Xiao Ming again stirring:

Do you remember Grandpa Wang is the phone director of the yard? He can manage the phone because he has an address book, because the same yard may have 2 children are called Xiaoming, by the name can not be distinguished, so there are only two lines in the Address book:

House phone

Gate 1234567 (This is Xiaoming's) IP and Mac correspondence

Gate Second, 7654321 (this is Xiao Li's)

......

Grandpa Wang has a bad memory, but this is always not wrong (the same yard will not have 2 "gate second" bar)? Every time I call someone to say to find the phone number, and then through the address book to the door to knock, such as people say I find "1234567", so Wang grandfather a comparison, oh, is a door, he went to knock a door "listen to the phone", if it is to find "7654321", then he looked for the door second

The phone number here is the legendary "IP address".

The house number here is the legendary "Mac" address of the network card (each NIC's MAC address is different, this is the network card manufacturer wrote dead in the chip of the network card)

Xiao Ming thought "Grandma's, I can not soak you do not want to bubble", so he played the king's grandfather Address book idea, after careful observation, careful preparation, he finally found that Grandpa Wang has frequent urination problems (after all, the old man ah ...) , finally in a month of black and high day, Grandpa Wang went to the toilet, Xiao Ming secretly touched into the front, carefully changed the Wang Grandfather's address book ...

After a few days, Xiao Li's boyfriend again to call Li, the other party reported the phone is "7654321", Wang Grandpa a look at the address book, by:

House phone

Gate 1234567 (This is Xiao Ming's)

Gate 7654321 (Note: This is Xiao Li's, but was changed by Xiao Ming)

......

Grandpa Wang did not know changed Ah, so he went to find a door small clear, Xiao Ming in the heart of this beautiful ah, he to Xiao Li father's tone of the harsh lesson of the man and Xiao Li between the improper relationship between men and women, the result of the man's respectfully hung up the telephone. Of course, Xiao Li did not know the whole thing happened ...

Here Xiao Ming's behavior is called "ARP spoofing" (because in the actual network by sending ARP packets to achieve, so called "ARP spoofing"), Grandpa Wang's address book is called "ARP table"

Here to note: Grandpa Wang now has two contacts, one is to record each yard of the telephone book, called "Routing table", one is now said to record the details of the yard, called "ARP table."

One of Grandpa Wang's system is written in this way. "Every month to re-examine the house number and telephone corresponding to this (that is, ARP table)", this action is called "Refresh arp table", the time limit for each month is called "Refresh ARP table cycle." So Xiao Ming in order to let that man can never find Xiao Li, and then every month to secretly change the address book, but this is also have to do!

To add, Xiaoming is very clever, if the Address Book (ARP table) is changed to this:

House number (MAC) phone (IP)

Gate 1234567 (This is Xiao Ming's)

Gate Second 1234567 (note: This was changed by Xiao Ming, but he was dizzy to change the wrong) is two Mac corresponding to the same IP address

......

will be the computer will pop up a dialog box prompting "Duplicate IP address", will eventually lead to Grandpa Wang at a loss, so inform the door and gate second, your phone repeated. So little Li knew someone was destroying her good, and this phenomenon was called "the scam was revealed."

Little knew Xiao Ming overheard him and small dark telephone, so and small dark agreed to the password. The little boy told the dark after encrypting what he wanted to say at home. Potato-〉 Wednesday, sweet potato-〉 treat, fool-〉 little home. So the little boy told the Dark: Potato fool sweet potatoes. Xiao Ming listens??? Do not understand .... Depressed ... This is encryption.

In addition, Li also know Xiao Ming change his home phone number. So grandpa Wang went to one of the calls and the house number. and hide not allow outsiders to modify, can only have their own keys (password). This is the IP address and the MAC address binding. When someone changed their phone number, they had to look for grandpa Wang to change it. The trouble is trouble, but it's safe. But Xiao Ming secretly stole the key of Grandpa Wang with a (theft password success), so he can also modify.



ARP spoofing:

Xiao Wang, Xiao Zhang are living in a building (a, B computer in a network segment), to find them, must pass through the door Zhang (Gateway), and Zhang Grandpa's memory is not good, just according to Xiao Zhang Xiao Wang told him: I am Xiao Wang, I came to this record in a room, tell the visitors, you go to a room to find Xiao Wang. Under normal circumstances, you want to find Xiao Wang, first find Zhang, then, Zhang told you Xiao Wang in room A (computer A's address)

If Xiao Zhang always with Zhang Uncle said: In fact, I am Xiao Wang, in fact, I am Xiao Wang ... I'm in room B.

So when you came to Xiao Wang, Mr. Zhang told you that Xiao Wang is in room B ... As a result you think of Xiao Zhang as Xiao Wang, you have been fooled.

This is a case of ARP spoofing.

Another situation is that Xiao Wang in the virus (a kind of malicious code with stealth and destructive infectious), virus (a kind of malicious code with stealth and destructive infectious) constantly send ARP packets, tell Xiao Zhang, I am the janitor Zhang Ye, also tell others, I am Zhang Ye, you want to go out, you have to find me. Because Xiao Wang is not the real Zhang, a lot of janitor's work (gateway) Xiao Wang can not do, as a result, many people can not go to the network or to visit the website should not be downloaded virus (a kind of malicious code with stealth and destructive infectious), this is session hijacking.

This time about rising ARP firewall storm, a simple understanding, is this:

Xiao Wang to prevent ARP spoofing, every once in a while with the net shut ye say once: I am Xiao Wang, I in a room, you don't remember wrong ah ...

For a moment, and again, Zhang said, oh, I know. (KAO, there is nothing to ask, you are annoying ah. ）

The problem arises:

Xiao Wang kept shouting: "I am Xiao Wang, I am a little King", shouting and shouting, Zhang Ye is bored to death, if everyone in the building is not listening to Zhang Grandpa said this sentence .... Zhang replied: "I know." I'm afraid this uncle Zhang, has kept saying "know it". The coming and going, everyone is so toss this big uncle, the front (gateway) was blocked.

1, the corridor people come and go, normal walking affected (slow speed, a lot of ARP packets passed)

2, this small Zhang, Xiao Wang, Xiao xx ... And so on dozens of hundred people shout ah, shout Ah, Zhang Ye will have to keep the answer: good, know, but also to record down, there is no time to do other things. (Enable CPU load on network devices such as routers on the uplink)

What is the solution?

1. Don't let a bunch of people shout at Uncle Zhang, broadcast in a small area.

2. Do not shout too often, the time interval is longer.

Using the method above to prevent ARP viruses and deception, in some cases, is not worth the candle.

The most thorough way to deal with ARP viruses is to have two-way IP, MAC bindings between the switch port (the current on one end of the network is equal to the current output from the other side) and the local port (the current on one end of the network is equal to the current at the other end of the output), which is really a physical activity. Can put the network management tired of death, anti-virus is very important.

linux-Understanding ARP, gateway, routing