1

Consider the following ARP packets captured while a unix machine was booting.

ARP packets

From the packets I understand that this machine whose MAC address is 00:22:22:22:22:22 is requesting information about which MAC address is the ip 192.160.100.20 assigned to, (packets 1-4)

Then there are two packets (id 5,6) that I don't fully understand. I am guessing that the machine ask for the IP and then assings it MAC address to it. Am I right? Can you provide precise information about what is the purpuse of the packets 5 and 6 individually?

1 Answer 1

0

This system possibly runs fake with a default configuration. Gratuitous ARP replys are usually used to install and/or update entries in the ARP caches of other system in the network. In this case the system broadcasts the ARP reply and 2 seconds later sends an ARP request with a similar purpose. The second one is done since some OSes reject gratuitous ARP replys but still sniff the network for ARP requests and use the sender information in them to update their ARP caches. In this case, the intended use is for a backup server to take over the IP of a failed one by forcing the rest of the network equipment to update its ARP caches and start talking to the newly brought up machine instead.

If you are interested, the corresponding lines of code in fake are 277-304:

if [ "${IFCONFIG}" = "TRUE" ]; then
  # Setup the target interface, route and send gratuitous arp
  /sbin/ifconfig "$TARGET_INTERFACE" $SPOOF_IP netmask $SPOOF_NETMASK \
    broadcast $SPOOF_BROADCAST \
    || die "Could not bring up interface"
  /sbin/route add -host $SPOOF_IP "$TARGET_INTERFACE" \
    || warn "Could not add local route"
fi

# Get the mac address to use
set_MACADDR $TARGET_INTERFACE

#Send gratutious arp
log "Sending endless Gratuitous Arp."
while [ 1 ]; do
  /usr/sbin/send_arp \
        ${SPOOF_IP} ${MACADDR} \
        ${SPOOF_IP} ${MACADDR} \
        ${TARGET_INTERFACE} ${MACADDR} FF:FF:FF:FF:FF:FF reply \
     || die "Could not send gratuitous arp"
  sleep $ARP_DELAY
  /usr/sbin/send_arp \
        ${SPOOF_IP} ${MACADDR} \
        ${SPOOF_IP} 00:00:00:00:00:00 \
        ${TARGET_INTERFACE} ${MACADDR} FF:FF:FF:FF:FF:FF request \
     || die "Could not send gratuitous arp"
  sleep $ARP_DELAY
done

/usr/sbin/send_arp used in the infinite ARP spoofing loop is a small C program that is part of fake and is used to send the spoofed ARPs.


It could also be part of an address resolution mechanism. When one network host believes that it owns a given IP, it would broadcast a gratuitous ARP to the network in order to force conflicts in other machines that possibly have the same IP. For example, when it receives such an ARP message matching its own IP address, Windows displays the infamous bubble notification that there is an address conflict on the network. This is used by DHCP clients in order to assess if some other network host holds the IP address offered by the DHCP server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .