	        --[  arp-sk Options manipulation  ]--

	      Frederic Raynal <pappy@security-labs.org>



-- --[  Modes  ]-- --

There are 2 basics mode:
  - who-has: build a request ARP message. 
  - reply: build a reply ARP message (default)

Other advanced modes should come very soon
  - arping: send a who-has to every host on the LAN to see who is here
  - promisc: detection of boxes that are sniffing on the network using
             promiscuous mode of their network interface
  - arpmim: perform Man in the Middle attack


-- --[ Link level options  ]-- --

-s: set the source address of the packet. 
    Default : MAC address of the interface used to send the packets.

-d: set the destination address of the packet
    Default: broadcast

These 2 options have a strong influence on the ARP message itself.
Here are the default according to these options:

  - request

      # ./arp-sk -i eth1 -w
      + Running mode "who-has"
      + IfName: eth1
      + Source MAC: 52:54:05:f4:62:30
      + Source ARP MAC: 52:54:05:f4:62:30
      + Source ARP IP : 192.168.1.1 (batman)
      + Target MAC: ff:ff:ff:ff:ff:ff
      + Target ARP MAC: 00:00:00:00:00:00
      + Target ARP IP : 255.255.255.255 (255.255.255.255)


  - reply

      # ./arp-sk -i eth1 -r
      + Running mode "reply"
      + IfName: eth1
      + Source MAC: 52:54:05:f4:62:30
      + Source ARP MAC: 52:54:05:f4:62:30
      + Source ARP IP : 192.168.1.1 (batman)
      + Target MAC: ff:ff:ff:ff:ff:ff
      + Target ARP MAC: ff:ff:ff:ff:ff:ff
      + Target ARP IP : 255.255.255.255 (255.255.255.255)

  The only difference comes from the destiantion mac address from ARP
message, since it has to be 00:00:00:00:00:00. For the reply mode,
consistency is preserved and the destination MAC address used for the
link layer is copied in the ARP message.


-- --[  ARP message  ]-- --

  This default comportment is almost dumb, especially if you look at
the destination part of the ARP message. Hence, it is necessary to
provide destination addresses to avoid that. You can play with -D
which accepts several inputs -D <hostname|hostip>[:MAC]

If you use at the same time -d and -D, everything you specify is put
exactly where it should :
  -d in the link layer
  -D in the ARP message
If you don't provide a MAC address with the -D, the one from the link
layer is used.


The logic is almost the same for the source parts of the ARP message.
If you intend to spoof addresses, you will need to play with the
argument  -S <hostname|hostip>[:MAC] 

Note that several writings are legal :

  - just set the IP address -> -S 1.1.1.1
  - just set the MAC address -> -S :11:11:11:11:11:11
    DO NOT FORGET THE ':' AT THE BEGINNING, otherwise, arp-sk will
    consider there is a mistake here
  - both IP and MAC -> -S 1.1.1.1:11:11:11:11:11:11


Of course, you can perform the same tricks with the destination (-D)


-- --[  A feature, not a bug ...  ]-- --

Ok, it will be a feature, but it is a bug a the present time.  If you
provide a MAC address, but no IP one, the arping way is used to
resolve the addresses. So for instance:

    # ./arp-sk -c 1 -t 1 --beep -i eth1 -s 11:11:11:11:11:11 -D 1.2.3.4
    option beep
    - Warning: no mode given, using default.
    + Running mode "reply"
    + IfName: eth1
    + Source MAC: 11:11:11:11:11:11
 -> Wrote ICMP timestamp (54 bytes) to retrieve IP address ... 
    - Warning: can't resolve from mac 11:11:11:11:11:11 => use local one.
    + Source ARP MAC: 11:11:11:11:11:11
    + Source ARP IP : 192.168.1.1 (batman)
    + Target MAC: ff:ff:ff:ff:ff:ff
    + Target ARP MAC: ff:ff:ff:ff:ff:ff
    + Target ARP IP : 1.2.3.4 (1.2.3.4)

    --- Start sending --
    (1) To: ff:ff:ff:ff:ff:ff From: 11:11:11:11:11:11 0x0806
        ARP For 1.2.3.4 (ff:ff:ff:ff:ff:ff):
            192.168.1.1 is at 11:11:11:11:11:11

    --- 1.2.3.4 (ff:ff:ff:ff:ff:ff) statistic ---
    To: ff:ff:ff:ff:ff:ff From: 11:11:11:11:11:11 0x0806
        ARP For 1.2.3.4 (ff:ff:ff:ff:ff:ff):
            192.168.1.1 is at 11:11:11:11:11:11
    1 packets tramitted (each: 96 bytes - total: 96 bytes)

The -s flag is used to set the mac address at the link layer. Since no
information is provided for the ARP message, arp-sk attempts to
retrieve the IP address bound to 11:11:11:11:11:11. Thus, it sends an
icmp-timestamp to a broadcast address and wait for an answer. 

Since it does not receive any, it choses to use the local IP address,
and arp-sk goes its way.

BUT, unfortunately there are still some troubles with libnet 
1.1.0-beta6 since it can't handle multiple packets. Hence, the next
packet send is bugged :-(

To go around that trouble, I add the --use-ts flag. By default, no
icmp-timestamp will be sent. If you really want to have this feature
(aka bug) turned on, add if on the command line. Note that it has been
used in all the above examples, even if it does not appear.


-- --[  Address resolution  ]-- --

The main address resolution process is very simple. It is almost
similar to look up in /proc/net/arp. So, you should have /proc
filesystem enabled on your system or it won't work. Moreover, I've
never test what could then happen ... So, use at your own risks.

This part will be rewritten later, since getting either the IP or MAC
address from /proc/net/arp works fine, even if it is not very
portable. Moreover, no check is performed to see if the result is
still valid or not (it can be in this file, but the addresses can have
change). 
