Arp attack introduction and Prevention

ARP attack prevention
1. To prevent arp attacks, what is arp?
ARP: Address Resolution Protocol, used to resolve a 32-bit IP address to a 48-bit physical mac address.
In the Ethernet protocol, it is required that hosts in the same LAN communicate with each other, and the physical address (mac address) of the Peer must be known. In the TCP/IP protocol, the network layer and transport layer only care about the IP address of the target host. In this case, when the IP protocol is used in Ethernet, the Ethernet protocol at the data link layer is connected to the data provided by the IP protocol at the upper layer and only contains the IP address of the target host. Therefore, a protocol is required to obtain the mac address of the destination IP address. So arp came into being.
In addition, when the sending host and the target host are not in the same LAN, even if they know the MAC address of the target host, the two cannot communicate directly and must be forwarded through a route. Therefore, what the sending host obtains through the ARP protocol is not the real MAC address of the target host, but the MAC address of a port that can access a vro outside the LAN. Then, all frames sent from the host to the target host will be sent to the vro and sent out through it. This situation is called ARP Proxy ).
Ii. Principles of arp attacks
ARP attacks implement ARP spoofing by forging IP addresses and MAC addresses, which can generate a large amount of ARP traffic in the network to block the network, attackers can change the IP-MAC entries in the ARP cache of the target host as long as they continuously generate forged ARP response packets, resulting in network interruptions or man-in-the-middle attacks.
ARP attacks mainly exist in LAN networks. If a computer in LAN is infected with an ARP Trojan, the system infected with the ARP Trojan will attempt to intercept the communication information of other computers in the network through ARP spoofing, and thus cause communication faults of other computers in the network.
Iii. What is arp spoofing?
In a lan, after receiving an ARP Request broadcast packet, A hacker can eavesdrop on the IP (MAC) addresses of other nodes. The hacker pretends to be A and tells B (the victim) A false address, so that all data packets sent by B to A are intercepted by hackers, And A and B are unaware of it.
Iv. arp attack methods:
1. IP address conflict
The Arp virus maker creates the illusion that another host shares an IP address with the affected host on the LAN. A large number of attack packets can consume a large amount of system resources on the affected host.
① Unicast IP address conflict
The destination physical address recorded on the data link layer is the physical address of the attacked host, so that the arp packet can only be received by the attacked host, but not by other hosts in the LAN, attack attack.
② Broadcast IP address conflict
The physical address of the data link layer record is the broadcast address, so that all hosts in the LAN will receive the arp packet, although the destination IP address recorded by the arp packet is not the IP address of the attacked host, because the arp packet is a broadcast packet, the attacked host will also receive it.
2. arp flood attacks
Attack hosts constantly map forged mac-ip addresses to affected hosts, broadcast all hosts and network administrators in the LAN, and seize network bandwidth and interfere with normal communication.
3. arp scan attacks
An Arp attacker sends an arp request to the LAN to obtain the ing between the IP address and the MAC address of the running host. The attack source obtains the IP address and mac address to be attacked through arp scanning, so as to listen to the network and steal user data, and prepare for a disruptive attack.
4. Virtual Host Attack
Hackers create virtual NICs in the network, Virtualize themselves into a host in the network, and have Virtual Physical addresses and IP addresses. In this way, IP Address Resources in the LAN are occupied, so that IP addresses conflict with normal hosts, and a large number of virtual host attacks make the hosts in the LAN unable to obtain the IP addresses normally.
5. arp spoofing attacks
The objective is to send a forged arp response to the target host, and enable the target host to receive the ing between the IP address and the MAC address in the response, and update the cache of the target host. This affects the smooth connection. These methods can be used to impersonate a host to spoof a gateway. The principle is to intercept gateway data and impersonate a gateway to spoof a host.
5. arp attack Prevention Measures
1. Static binding of IP addresses and MAC addresses on the client
Go to the command line arp-a command to view the local gateway IP address and gateway mac address.
Compile a batch processing content as follows:
@ Echo off
Arp-d
The IP address of the arp-s gateway's mac address.
Save it to the boot item
2. Set the arp Server
Specify a machine in the LAN as the arp Server, which stores and maintains the ing records of IP addresses and mac addresses of all hosts in a trusted range. The server checks its static arp cache records and sends arp requests to the local area network in the name of the host to be queried, at the same time, other hosts in the LAN are set to use arp responses from the arp Server.
3. Switch Port Settings
It is also a common prevention method to prevent ARP by dividing VLANs and binding vswitch ports. The practice is to carefully divide VLANs to reduce the scope of the broadcast domain, so that ARP works in a small range, without large-scale impact. At the same time, some network management switches have the MAC address learning function. After learning, disable this function to bind the corresponding MAC address and port, prevents viruses from using ARP attacks to tamper with their own addresses. That is to say, the risk of data interception in ARP attacks is eliminated. This method does play a certain role.
However, the problem between VLAN binding and switch port binding is:
① There is no protection for the gateway. No matter how VLAN is subdivided, once the gateway is attacked, it will still cause disconnection and paralysis of the entire network.
② It is too rigid to fix every computer firmly on a switch port. This is not suitable for mobile terminals. from the Office to the conference room, I am afraid this computer will not be able to access the Internet. What should I do with wireless applications? Other methods are needed.
③ When port binding is implemented, all advanced network management switches and layer-3 switches must be used. The cost of the entire switch network is greatly increased.
Because the exchange network itself supports ARP operations unconditionally, its own vulnerabilities may cause ARP attacks, and its management methods are not for ARP. Therefore, implementing ARP prevention measures on the existing exchange network is a shield against attacks. In addition, complicated operation and maintenance is basically a thankless task.
4. ARP Personal Firewall
In some anti-virus software, the ARP Personal Firewall function is added. It binds the gateway on the terminal computer to ensure that the gateway is not affected by the fake gateway in the network, this protects your data against theft. The arpfirewall is widely used. Many people think that with the firewall, ARP attacks do not constitute a threat. In fact, this is not the case.
ARP Personal Firewall also has major defects:
① It cannot ensure that the bound gateway is correct. If ARP spoofing has already occurred in a network and someone is forging a gateway, the ARP personal firewall will bind the wrong gateway, which is highly risky. Even if a prompt is not sent by default in the configuration, users who lack network knowledge may be at a loss.
② ARP is a problem in the network. ARP can both forge a gateway and intercept data. It is a "dual-headed monster ". ARP defense on a personal terminal is not a complete solution, no matter what the gateway is. ARP Personal Firewall is used to prevent data from being stolen. However, ARP Personal Firewall is powerless to address network problems, such as disconnection and lag.
Therefore, the ARP Personal Firewall does not provide reliable assurance. Most importantly, it is a measure unrelated to network stability. It is personal, not a network.
5. Install the monitoring software
Sniffer software can be installed to listen to arp packets in the network. Due to arp spoofing, it is often broadcast. Even in the vswitch environment, it can obviously listen to a PC and send an arp packet, you can locate the source host of the arp virus.
6. Anti-Spoofing
Run the command to set an incorrect gateway address, anti-spoofing arp, and then add a static route. Set the correct gateway for normal network access.