course hero 1. explain what happens when you run arpspoof?

How does ARP work?

An ARP spoofing, also known as ARP poisoning, is a Man in the Middle (MitM) attack that allows attackers to intercept communication between network devices. The attack works as follows: 1 The attacker must have access to the network. They scan the network to determine the IP addresses of at least two devices⁠—let’s say these are a workstation and a router. 2 The attacker uses a spoofing tool, such as Arpspoof or Driftnet, to send out forged ARP responses. 3 The forged responses advertise that the correct MAC address for both IP addresses, belonging to the router and workstation, is the attacker’s MAC address. This fools both router and workstation to connect to the attacker’s machine, instead of to each other. 4 The two devices update their ARP cache entries and from that point onwards, communicate with the attacker instead of directly with each other. 5 The attacker is now secretly in the middle of all communications.

How to identify poisoned ARP packets?

Use packet filtering⁠—packet filtering solutions can identify poisoned ARP packets by seeing that they contain conflicting source information, and stop them before they reach devices on your network.

What happens when two devices update their ARP cache?

The two devices update their ARP cache entries and from that point onwards, communicate with the attacker instead of directly with each other.

What is static ARP?

Use static ARP⁠—the ARP protocol lets you define a static ARP entry for an IP address, and prevent devices from listening on ARP responses for that address. For example, if a workstation always connects to the same router, you can define a static ARP entry for that router, preventing an attack.

What is VPN in ARP?

Use a Virtual Private Network (VPN)⁠—a VPN allows devices to connect to the Internet through an encrypted tunnel. This makes all communication encrypted, and worthless for an ARP spoofing attacker.

What is ARP cache?

Hosts maintain an ARP cache, a mapping table between IP addresses and MAC addresses, and use it to connect to destinations on the network. If the host doesn’t know the MAC address for a certain IP address, it sends out an ARP request packet, asking other machines on the network for the matching MAC address.

Can an attacker steal data?

Continue routing the communications as-is⁠—the attacker can sniff the packets and steal data, except if it is transferred over an encrypted channel like HTTPS.