Use ARP to detect active hosts over Ethernet

Author: yztgx
E-mail: yztgx@163.net
Date: 2004-4-13

There are many articles about ARP on the Internet, most of which are about ARP spoofing. Here we will introduce the alternative usage of ARP: To detect whether the target host is active.
The traditional method for detecting whether a remote host is alive is to ping the echo response message in ICMP protocol ). With more and more security awareness and attention, many hosts Mask ICMP packets to avoid being detected by scanners, so as to hide the packets in the network.
The following describes how to use ARP to detect active hosts on the network. The disadvantage of this method is that it can only detect active hosts on the Ethernet.
First, let's take a look at the ARP protocol. ARP is the abbreviation of Address Resolution Protocol. It is used to convert an IP Address to a physical Address (MAC Address ), for detailed procedures, refer to "TCP/IP details". The format of ARP packets is as follows:
------------------------------------------
Ethernet Destination Address (6 bytes)
Ethernet source address (6 bytes)
Frame Type (ARP = 0806) (2 bytes)
------------------------------------------
Hardware type (Ethernet = 01) (2 bytes)
Protocol type (IPv4 = 0800) (2 bytes)
Hardware address length (1 byte)
Protocol address length (1 byte)
OP Operation Option (ARP request = 01, ARP reply = 02) (2 bytes)
Sending end ethernet address (6 bytes)
Sending IP address (4 bytes)
Destination ethernet address (6 bytes)
Destination IP address (4 bytes)
--------------------------------------------

We send an ARP request to the target host. If the target host is active, its MAC address is returned. If the target host returns the MAC address, the target host is active. The content of the ARP request package is as follows:
------------------------------------------
Ethernet Destination Address | FFFFFFFFFFFF (broadcast address)
Ethernet source address | Local MAC address
Frames | 0806
------------------------------------------
Hardware type | 01
Protocol type | 0800
Hardware address length | 06
Protocol address length | 04
OP Operation Option | 01
Sender's ethernet address | Local MAC address
Sender IP address | destination host IP Address
Destination Ethernet IP address | 000000000000
Destination IP address | destination host IP Address
--------------------------------------------
Note: The destination ethernet address is ffffffffff, which is a broadcast address. All hosts on the Ethernet can receive this packet. After receiving this packet, the operating system determines whether the destination IP address is the host, if not, the packet is discarded (not processed). Otherwise, an ARP response packet is sent back. The packet content is as follows:
------------------------------------------
Ethernet Destination Address | MAC address of the probe host
Ethernet source address | Local MAC address (local indicates the host to be tested)
Frames | 0806
------------------------------------------
Hardware type | 01
Protocol type | 0800
Hardware address length | 06
Protocol address length | 04
OP Operation Option | 02
Sender ethernet address | Local MAC address (local indicates the host to be tested)
Sending IP address | Local IP address (local IP address refers to the monitored host)
Destination ethernet address | MAC address of the probe host
Destination IP address | IP address of the probe host
--------------------------------------------

We can use Pcap to construct this data packet (for details about the process, refer to the relevant documentation of Pcap. Here we use SendARP (), SendARP () is a function provided by the Microsoft Platform SDK to obtain the MAC address of the target host. The prototype of the SendARPSendARP function is as follows:
DWORD SendARP (
IPAddr DestIP, // target IP Address
IPAddr SrcIP, // source IP address
PULONG pMacAddr, // returns the MAC address pointer
PULONG PhyAddrLen // returns the MAC address Length
);


In the following example, MSND can be used as an active host detection tool over Ethernet.
//
// Link with ws2_32.lib and iphlpapi. lib
//

# Include <windows. h>
# Include <stdio. h>
# Include <tchar. h>
# Include <iphlpapi. h>


Int _ cdecl main ()
{
HRESULT hr;
IPAddr ipAddr;
ULONG pulMac [2];
ULONG ulLen;

IpAddr = inet_addr ("192.168.0.1 ");
Memset (pulMac, 0xff, sizeof (pulMac ));
UlLen = 6;

Hr = SendARP (ipAddr, 0, pulMac, & ulLen );
Printf ("Return % 08x, length % 8d", hr, ulLen );

Size_t I, j;
Char * szMac = new char [ulLen * 3];
PBYTE pbHexMac = (PBYTE) pulMac;

//
// Convert the binary MAC address into human-readable
//
For (I = 0, j = 0; I <ulLen-1; ++ I ){
J + = sprintf (szMac + j, "% 02X:", pbHexMac [I]);
}

Sprintf (szMac + j, "% 02X", pbHexMac [I]);
Printf ("MAC address % s", szMac );

Delete [] szMac;

Return 0;
}

Personal research, may understand not very comprehensive, there are problems can send mail yztgx@163.net Communication