
/*-----------------------------------------------------------------------*/
/*                       R I N G 0,    I S S U E   # 1                   */
/*-----------------------------------------------------------------------*/

                       ARP

                                                          by ZaDNiCa/UINC

           ,   
        .   
    OSI        (Data  link  layer)
    (frame).     .
        (header),    
,          (trailer)    
  (    ).  
    ,        
          .      
   ,   MAC- (
Media  Access  Control  -        ).  
       .

         MAC   DIX
        MAC -    | IP  | FCS (  MAC )

         MAC   DIX Ethernet
        000102030405 | 060708090A0B   | 0C0D
        Dst MAC      | Src MAC        | Tp

        :
        Dst MAC - Destination Hardware Address
        Src MAC - Source Hardware Address
        Tp - Protocol Type

    ,               
    .    
         .  
    (Address  Resolution  Protocol  - ARP) 
          IP-    
     .
        ARP  
    (    
    ARP-).        
           ,      IP-   
ARP-,      .  
   IP-          ,  
      ARP,      IP-
.       MAC        
FF:FF:FF:FF:FF:FF.          IP-  
.                 
 IP  MAC ,    IP-   
    ARP-   , 
      .   ,  ,
    ,          ARP  
      .

    ARP

     
  
    2            
    2             
    1            
    1             
    2           : 00 01 - , 00 02 - 
    *            
    *             
    *            
    *             

     ARP 
  Offset  000102030405060708090A0B0C0D0E0F
  0000:   FFFFFFFFFFFF00409501590108060001
  0010:   0800060400010040950159010A000006
  0020:   0000000000000A000001

        NetXRay
                     Ethernet Version II
  Address                       00-40-95-01-59-01FF-FF-FF-FF-FF-FF
  Ethernet II Protocol Type             ARP (08 06)
                 Address Resolution Protocol
  Hardware Type Ethernet                 (00 01)
  Protocol Type IP Protocol              (08 00)
  Hardware Address Length              6 bytes (06)
  Protocol Address Lenght              4 bytes (04)
  Operations                        ARP Request (00 01)
  Source Hardware Address            00-40-95-01-59-01
  IP Source Address               10.0.0.6 (0A 00 00 06)
  Destination Hardware Address      00-00-00-00-00-00
  IP Destination Address          10.0.0.1 (0A 00 00 01)
                  Calculate CRC: 0x6ffd5fa9

    ARP-   ""      
ping  10.0.0.1.    ARP-     IP- -  
  .    Destination Hardware Address 
-    (00:00:00:00:00:00).
      ,    IP   
    ARP-.     
ARP.
  > ARP -a     
  > ARP  -a  <IP>  [IA]   MAC    <IP> 
 IA
  > ARP  -d <IP> [IA]      <IP>   
 IA
  > ARP -s <IP> <MAC> [IA]     IA

       ARP ?   -  
,      ARP-    
  (      )    ARP    (
  Solaris,    ARP ,    ARP
).              , 
.
        ?       , 
-  IP  MAC,      , 
IP-          MAC.
     ,         
      .    ,       
"".               
(    )   ARP . 
          , IP
       ARP .    
       .   
    ARP       . 
               ,
      ARP         .  
               ,    
    ARP      .  
    ,      
    .     , 
            ,  
  .
   :
            ping      -t  (  
).          ARP-, 
  ARP    MAC-.  ARP-  
      NetXRay,         
.    :
      >ping -t 10.0.0.1
         10.0.0.1  32 :
        10.0.0.1:  =32 <10 TTL=128
        10.0.0.1:  =32 <10 TTL=128
        10.0.0.1:  =32 <10 TTL=128
        10.0.0.1:  =32 <10 TTL=128
          .
          .
          .
          .
        10.0.0.1:  =32 <10 TTL=128
        10.0.0.1:  =32 <10 TTL=128
        10.0.0.1:  =32 <10 TTL=128
        10.0.0.1:  =32 <10 TTL=128

   ,    .    ,
    ARP-   MAC   ?
           IP-
10.0.0.1          ping. 
  ,             
IP-,      ARP-        MAC  IP
(    ping      ).   
    ,     (  
35-40 )  ARP-    ,   
  -         
  ,   ARP-,     MAC
 IP    .
           ?   
    ARP  .          ( ,  
      ),     ,
                 
.           
 .
      ,         
       ARP-  Windows NT 4.0
(Service  Pack  5).        ,    
    ARP-.  :
      arp -s 10.0.0.1 00-95-40-20-40-01
    :
      arp -a

      : 10.0.0.6 on Interface 2
       IP   
      10.0.0.1 00-95-40-20-40-01 

    ,     -  ,    .
  ,        . 
      -     ARP- (Src IP: 10.0.0.1, Src MAC:
00-11-22-33-44-55,  Dst IP: 10.0.0.6, Dst MAC: 00-40-95-01-59-01). 
  :
      arp -a

      : 10.0.0.6 on Interface 2
       IP   
      10.0.0.1 00-11-22-33-44-55 

    ?   , ..    
  ARP-      ,    MAC-   
   ARP-!     
Windows  95/98/Me,        Windows  2000  (Professional,  Advanced
Server).          ,    , 
    ,  , .
    ,   Tiny Personal FireWall,
AtGuard,  OutPost  -           .  
    IP-  (TCP,  UDP, ICMP ).
  ,        ARP-.  ,  
    .
           Conseal, 
        IPX, ARP,   
TCP/IP.           ARP-. 
            MAC    IP 
        .   Conseal 
,         ARP-.          
 ,    ARP-.
    ,       ARP-,
      "   ARP  ".      ,
    ,      ,   
.        ,    
    .

                                     1

         (1) ------ [1]          [2] ------ (2)
         IP1/MAC1                                             IP2/MAC2
            ^                                                    ^
            |      ________________________________________      |
            |     |                                        |     |
             ---> |  1           2 | <---
                  |  IPs2/MACs2                 IPs1MACs1  |
                   ----------------------------------------

         1      IP  2, 
        1  ,    
    2  2.      : IP-
    MAC-,      Src MAC=MAC1, Dst MAC=MACs1. 
   1      ,       
    2.  IP-      MAC-, 
  Src  MAC=MACs2,  Dst  MAC=MAC2    .    ,
    2     2.  
           " ARP-".
                ,
      .      
       . ,  ,
   .

                                     2

         (1) ------ [1]          [2] ------ (2)
         IP1/MAC1                                             IP2/MAC2
            ^                                                    ^
            |                       [3]                   |
            |                       | ( )           |
            |                       |                            |
             ---------------------> (3) <--------------------
                                    IP3/MAC3

        3 ()    
    1   2.    ARP- 
 3    ARP- 1  2:

            1. ARP   1
            MAC-    Src MAC:MAC3
                        Dst MAC:MAC1
            ARP-   Src IP :IP2
                        Src MAC:MAC3
                        Dst IP :IP1
                        Dst MAC:MAC1

            2. ARP   2
            MAC-    Src MAC:MAC3
                        Dst MAC:MAC2
            ARP-   Src IP :IP1
                        Src MAC:MAC3
                        Dst IP :IP2
                        Dst MAC:MAC2

        ,  ARP-
  :
      1: IP2:MAC3
      2: IP1:MAC3
      1    ,    2 
    MAC-  MAC3,           2 
  1.
    3    ""      
  

    (Ethernet)    MAC1->MAC3(IP1->IP2)    
MAC3->MAC2(IP1->IP2)   ;

    (Ethernet)    MAC2->MAC3(IP2->IP1)    
MAC3->MAC1(IP2->IP1)   .
    ,      ARP- 
1      2   -            ARP-  
"".            3  
        1  2.   
                ,    
        ,    
.   ,   ,   3,
         -       -        
-,      -            
.
       ,      ?
     ARP-   , 
   (POP3-, telnet   ..),  
       default gateway,   ,   
telnet'  (           Windows-).
             ARP-IP      
        .  
        ARP-      
  .       , 
,         MACx,       MACs.
   ,          ,    MACx.  
      .          
                  
      MAC- 
.  IP-          (   
    Windows  NT),          
   MAC         Windows   NT   (  ,
         )        .
,         ,      MAC-  
        (   ). ,
,     ,   
 ,        .  ,
     Realtek8029, WinBond, 3Com   MAC-,
    :

   win9x:

  [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\Net\0000] -
         2   (string):
      "NetworkAddress"="xx-xx-xx-xx-xx-"
      "SelectedID"="xx-xx-xx-xx-xx-"
       xx-xx-xx-xx-xx- -  MAC-,    .

   winNT:

  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<>\Paramet
                                                                     ers]

      "NetworkAddress"="xx-xx-xx-xx-xx-"
      "SelectedID"="xx-xx-xx-xx-xx-"

        ,      ,  
          MAC-  -     
""    ?         
MAC-   .

     .    .
            ARP-.  
            .  
    . ,    
    ""    MAC-     
.
                . -,  
   ,    
              
.    ,    ,  ""  
        MAC-.
             
               
,               
.      ,       .  ,
        MAC-     
.     Windows NT  
.      MS loopback    
.                
  ,          
IP-.
        .   
 :

   >route print
   ======================================================================
          
         0x1MS TCP Loopback interface
         0x220 4c 4f 4f 50 20MS LoopBack Driver
         0x300 40 95 01 59 01Winbond W89C940 PCI Network Adapter
   ======================================================================
   ======================================================================
          :
          
         0.0.0.00.0.0.010.0.0.710.0.0.61
         0.0.0.00.0.0.010.0.0.25010.0.0.71
         10.0.0.0255.255.255.010.0.0.610.0.0.61
         10.0.0.0255.255.255.010.0.0.710.0.0.71
         10.0.0.6255.255.255.0127.0.0.1127.0.0.11
         10.0.0.7255.255.255.0127.0.0.1127.0.0.11
         10.255.255.255255.255.255.25510.0.0.710.0.0.71
         127.0.0.0255.0.0.0127.0.0.1127.0.0.11
         224.0.0.0224.0.0.010.0.0.610.0.0.61
         224.0.0.0224.0.0.010.0.0.710.0.0.71
   ======================================================================
   :
     0x1:MS TCP Loopback interface
     0x2:20 4c 4f 4f 50 20 (10.0.0.7):MS LoopBack Driver
     0x3:00 40 95 01 59 01 (10.0.0.6):Winbond W89C940 PCI Network Adapter

   ?  
      default gateway   3 - 10.0.0.7
      default gateway   2 - 10.0.0.250 <--  default gateway
         10.*.*.*    3
         10.*.*.*    2
             127.0.0.1
             127.0.0.1
             . 
              3,  ,
              (10.0.0.*)   
       .  :
      >route delete 10.0.0.0 if 3

      MAC-?   :
            10.0.0.6           IPr
            00 40 95 01 59 01  MACr
            10.0.0.7           IPv
            20 4c 4f 4f 50 20  MACv
      MACn/IPn - MAC/IP      
      MACw -  MAC

          3    
            MAC-       Src MAC: MACr
                           Dst MAC: MACv
            IP-  Src IP: IPr
                           Dst IP: IPn
                              Data

                 
 IP-  MAC-     3:
            MAC-       Src MAC : MACw
                           Dst MAC : MACn
            IP-  Src IP : IPr
                           Dst IP : IPn
                              Data

      3  MAC-:
            MAC-       Src MAC : MACw
                           Dst MAC : MACn
            IP-  Src IP : IPn
                           Dst IP : IPr
                              Data

     MAC-     :
            MAC-       Src MAC : MACv
                           Dst MAC : MACr
            IP-  Src IP : IPn
                           Dst IP : IPr
                              Data

            ,  "" (MAC)
          .  ,
       ,    
.
      ,  ,     , 
 .
        MAC-    .   
      ,     
MAC-     SoftIce.   ,  
     MAC-    -
      .          
      ,        .
    ,  -,  ,        
       (     
).         / , 
    ,       
100 -  (    ).
          ?         
 SoftIce   ,     
     .  SoftIce  
"Boot".          -  
.    ,   Winbond W89C940  E400-E41F.  MAC-
      E410h  (   10h).  
     .   MAC- ( 
       -    
,    ).
      "Boot"  .  
SoftIce,          (      ctrl-D) 
        E410h:
      :bpio e410 r
   :
      :x
          .      
       (    )
   SoftIce.     
- MAC-    .    MAC-
      AL             
.    ,       (F5). 6
  MAC-   ,   , 
    .  ..          6  ,
      ,   MAC-    .
          ,       
  .     SoftIce :
      :bc *
      :x
     .       
   MAC-.      :
      nbtstat -A <host_IP>
       5 .     
,          MAC-. 
,    -       MAC-?
 ,  ,   ,  
  .         ,
   ,  ,   ( MAC-
    )  -        ( 
      ,     
),       (    
   ).      , 
         
 MAC- - .

    ,        
,            
.                
      .   
         -       
 .

        Packet capture driver by
Netgroup of Politecnico di Torino PCCap,  :
http://netgroup-serv.polito.it/winpcap/

  :
   TCP/IP "Architecture, protocols, and implementation with IPv6 and IPv4
   security" - Dr. Sidnie Feit

u$e youR PoWeR iN GooD, NoT eViL
Be$T ReGaRD$ FRoM -=<ZaDNiCa>=-

$PeCiaL THaNK$ 2:
Nick, LeD0RuB, NiFi [uinC], ERRor, KMiNT21

