Future Snow
Hackers lie. Skillful hackers lie well. And well-rounded hackers can lie both to people and to machines.
Lying to people, known as "social engineering," involves tactics (detailed at length by convicted hacker Kevin Mitnick) such as posing as a company's employee so the company's real employees will blab secrets freely. Lying to machines involves lots of different techniques, and a commonly used one -- ARP Cache Poisoning -- is the focus of this article. ARP poisoning enables local hackers to cause general networking mayhem. Because it's mostly "incurable," every administrator should be aware of how this attack works.
ARP Refresher
In Foundations: What Are NIC, MAC, and ARP?, we explained that
Address Resolution Protocol (ARP) is how network devices associate MAC addresses with IP Addresses so that devices on the local network can find each other. ARP is basically a form of networking roll call.
ARP, a very simple protocol, consists of merely four basic message types:
An ARP Request. Computer A asks the network, "Who has this IP address?"
An ARP Reply. Computer B tells Computer A, "I have that IP. My MAC address is [whatever it is]."
A Reverse ARP Request (RARP). Same concept as ARP Request, but Computer A asks, "Who has this MAC address?"
A RARP Reply. Computer B tells Computer A, "I have that MAC. My IP address is [whatever it is]"