Exclusion of ARP spoofing fault

Failure phenomenon

Many users reflect frequent drop lines, and the local area network and internet links are suddenly slow or even disconnected. The reboot works fine, but after a few hours of work, the failure recurs.

Initial thought may be a virus or trojan caused by network congestion.

Network environment

The network environment of the unit is to divide the VLAN according to each floor, the VLAN that fails is Vlan7. All other users within the VLAN are normal, that is, the problem may be users within VLAN 7.

The IP address of the VALN 7 gateway is: 192.168.61.202, the corresponding MAC address is: 00-20-9-c-69-32-3f.

Users in the VLAN use DHCP to obtain the IP address, that is, dynamic acquisition.

Trouble shooting

To analyze a failed computer:

1. After checking use DHCP to obtain IP address normal, use Ipconfig/release to release IP address, use ipconfig/renew to regain IP address, success.

2. Using the MAC Address resolution tool to resolve the MAC address, enter it in the command line mode:

Arp–a

The command line executed successfully, as shown in the figure.

3. Execute the arp–a command on a computer that does not have such a failure, and the results are shown in the figure.

The comparison found that 2 computer-resolved gateways get different MAC addresses.

4. Use the LAN View Tool (Lansee) to scan the IP addresses and MAC addresses of all users under this VLAN, found that the fault machine MAC address for the 00-01-02-96-a8-24 corresponding IP is 192.168.61.49, the user name is WW, rather than the normal gateway 00-20-9c-69-32-3f.

5. Use ARP to bind the gateway of the failed machine to a normal gateway:

Arp-s 192.168.61.202 00-20-9c-69-32-3f

6. Install the "Anti arp Sniffer" ARP Detection tool on the fault machine, enable the "Get Gateway MAC Address" and "Enable automatic protection" feature, you can monitor the spoofing source.

After a while, a machine was found attacking the machine, as shown in the picture.

It can be concluded that the ARP spoofing in the VLAN is sent by the MAC address of the 00-01-02-96-a8-24 machine.

7. After locating the spoofed source, locate the computer that the user is WW, unplug the network cable, continue to monitor, the "Anti arp Sniffer" ARP Detection tool does not detect spoofed packets.

8. After the failure of the network, the use of anti-virus software to the machine anti-virus, clear Trojan, completed after the network access, tracking monitoring for some time after. No similar failures were found.

Deception mechanism

In the LAN, through the ARP protocol to complete the IP address conversion to the second level of physical address (that is, MAC address). ARP spoofing is achieved by spoofing IP address and MAC address, which can cause a large amount of ARP traffic in the network to block the network.

The ARP protocol is an abbreviation for "Address resolution Protocol" (Addressing Resolution Protocol). In the LAN, the actual transmission of the network is "frame", inside the frame is the target host MAC address. In a local area network, a host must be aware of the MAC address of the target host in order to communicate directly with another host. But how does this target MAC address get? It is obtained through the Address Resolution Protocol. "Address Resolution" is the process by which a host converts a target IP address to a target MAC address before sending a frame. The basic function of ARP protocol is to inquire the MAC address of target device through the IP address of target device, and ensure the smooth communication.

Use Host A (192.168.100.1) to send data to Host B (192.168.100.2) as an example. When sending data, host a looks for a destination IP address in its own ARP cache table.

If found, also know the target MAC address, directly to the target MAC address written in the frame to send on it; if the corresponding IP address is not found in the ARP cache table, host A sends a broadcast on the network with the destination MAC address "FF." Ff. Ff. Ff. Ff. FF, which means that all hosts within the same network segment are asked to do so, and other hosts on the network do not respond to ARP inquiries, and only Host B receives the frame and responds to host A. In this way, host a knows the MAC address of Host B, and it can send the message to Host B. At the same time it also updated its own ARP cache table, the next time to send a message to Host B, directly from the ARP cache to look up the list.

The ARP cache table, which uses an aging mechanism, is removed for a period of time if a row in the table is not used, which can greatly reduce the length of the ARP cache table and speed up the query.

The ARP protocol is based on trusting all the people in the local area network, so it is easy to implement ARP spoofing on the LAN. To target a spoofing, a to ping host C is sent to dd-dd-dd-dd-dd-dd this address. If you cheat, you cheat C's MAC address into DD-DD-DD-DD-DD-DD, so a packet sent to C will be sent to D.

Due to ARP spoofing Trojan program occurs when a large number of packets caused by the LAN traffic congestion and its own processing capacity restrictions, users will feel the speed of the Internet more and more slowly. When the ARP cheat Trojan program stops running, the user restores the Internet from the default gateway, and the user restarts the machine to return to normal.