Solution to ARP attacks on Mac

In Windows, if an ARP attack occurs, the solution is simple: "360 security guard" or "QQ Software management" provides real-time protection with ARP protection (disabled by default ), you only need to enable it.

However, it is not that convenient on Mac. Let's talk about the principle of ARP attacks first:

When we access the internet in the LAN, we always need to go out through the gateway. In the IP settings, the gateway sets a specific ip4 address (such as 192.168.1.1 ), however, IP addresses can be set randomly on each machine (as long as they do not conflict with other machines in the LAN). This is a logical virtual address, with only network devices (such as network cards) static MAC address. This is the actual physical address. All accesses to the IP address must be directed to the Mac physical address to directly communicate with the physical device. In the OSI Layer-7 network model, the IP address is in layer-7 mode, and the MAC address is in layer-7 mode. Therefore, ARP (Address Resolution Protocol) is required) address Resolution Protocol to act as translation.

During ARP attacks, the MAC address of the gateway is disguised for spoofing purposes. More commonly, when your machine accesses the gateway (such as 192.168.1.1), normally, you should locate the real physical address (such as A) of the Gateway Router, but after being attacked, it will be misled to other fake mac addresses (B), which is equivalent to your failure to access the gateway normally, it's not surprising that you cannot access the Internet.

After understanding the principles, we can solve the problem:

1,First, find the real physical address of the Gateway (that is, the MAC address of the router)

Install the virtual machine on the Mac, and then install windows on the Virtual Machine (enable ARP protection ), in this way, the environment will return to the familiar Windows (or find a Windows machine), provided that the machine is installed with the arpfirewall and can access the Internet normally), in the fate of windows, input ARP-

C: \ Users \ Jimmy. Yang> ARP-

Interface: 192.168.1.120 --- 0xb
Internet address physical address type
192.168.1.1 14-e6-e4-9b-38-aa dynamic
192.168.1.255 FF-FF static
224.0.0.2 01-00-5e-00-00-02 static
224.0.0.252 01-00-5e-00-00-fc static
239.00000000250 01-00-5e-7f-ff-fa static
Extends 00000000255 FF-FF static

From the returned results, we can know that the physical address of the 192.168.1.1 gateway is 14-e6-e4-9b-38-aa.

2,Return to the Mac environment and bind the gateway address to the physical address

In the terminal window, enter:Sudo ARP-s 192.168.1.1 14: E6: e4: 9B: 38: AA pub
Note: The preceding physical addresses are separated by ":", not "-"

In general, you can access the internet. If not, we recommend that you do not use DHCP to dynamically obtain the IP address, instead of manually specifying the IP address.