
/*-----------------------------------------------------------------------*/
/*                       R I N G 0,    I S S U E   # 1                   */
/*-----------------------------------------------------------------------*/

                 ARP and ICMP

                                          by Yuri Volobuyev & SOLDIER/UINC

                                                     
                          (There're bugs and there're features - )

      ,  .   2 
      TCP/IP-ARP      ICMP,       
,      .

  ,        ,  
(spoofing-             ,  .
)    DoS  (Denial Of Service -   ). IP-blind
spoofing  (        IP-) -   
        ,          
        .      ARP-
 .

 ARP-spoofing     ,   
          
     .

    [--  ARP--]

  ,         ARP,  
      W.Richard  Stevens "TCP/IP Illustrated". (.
 - ZDNC        
).    RFC826.

    [--  --]

	   .

IP         10.0.0.1    10.0.0.2   10.0.0.3    10.0.04
hostname     CAT         RAT        DOG         BAT
hwaddr      AA:AA       BB:BB      CC:CC       DD:DD ( )

         (,   
  ).     CAT . 
 -       DOG.  ,  DOG
    RAT,     -    
   RAT.

  ,        - "    
IP-   ..."     ,    
     .    Ethernet-  CAT, 
  IP-  10.0.0.2,       ARP-   IP. 
           RAT.     
  (     ).      
          (  
  IP-).      (   
  )     .   
        ,  -
MAC  - IP.      ,  .

   send_arp.c   (         )    
       .     ,
    ARP-  (ARP-,      :    
  ,          
)    ,             ,  
.           ,  
IP-        hw- (MAC).

      ""    Ethernet-.   
       ifconfig -arp. ,   
    ARP-  (      
OSI-           MAC-), 
  ,   ARP-    
arp  (8).       -   ( ) 
    .    ,    , 
,   DOG ,  - RAT     -
  (:).        ARP-      IP-
10.0.0.2,   hw-      :,  IP-    10.0.0.3  
hw-  :.   DOG ,  RAT- :. ARP-, ,
         (        
ARP-        ,       ).
       ,   , 
        40        . 
     -   .

               ARP-.
    (,  LINUX)        -,
  unicast  ()     .  
  ,        RAT     
,       .      ,  
,        ARP-,   ARP- 
,      ARP-. ,  ,
    .   ,     DOG  RAT
    ,        ARP-  . 
 ,   40 .  .

,    . "" (bring up) -,
.. eth0:1 (  ,   )  IP- RAT 
  ARP-    - ,  
       ARP.        DOG  
  .    -   DOG  
 ARP.     .

       send_arp  DOG   RAT 
  DOG  ,         RAT.    
  ARP-  DOG  RAT.

    ,  ,         (,
       ARP-,  
    ).     ,  
    DOG hw-  hw- .
       (    ,          ,
ARP-      ),  
             
(,        - . ).   
        ,  ,    
       .

      ( -  "  ")
,        Linux       ,   
      ,  ARP-  ,      ARP-
       Ethernet-,   
       ARP-  .  SunOS  
      (  ,     
    )      ARP-  , ,
ARP-    .   Windows 95    
Linux,      ,     ( ) 
ARP-   MAC- ;     
   LAN  Win95       ARP-.
  WinNT  4.0          ARP-, 
ARP-  MAC-    5 .

    [--    --]

  ,       ,   
      ARP-. DoS (Denial Of Service
-         -  .  )  -    
.       hw-,   
 "".       
    (  )      (    ARP-  
   ARP-   LAN).  
        .    ARP-   
    :   -   ,  
         ,    
.                     
  .     ,   
,                 
ARP-. ,      ARP-,  
""  ,         . 
  -     hw- , 
""     .  ,     ,
      ,       
,            -  ,
  ,      ICMP-    3 "ICMP Xxxx
Unreachable"      -,         
    .      
            ARP-.      Linux,   ,
         (  ,
      -)   1 .  10
.          (  )  TCP-  
 (screw up).

         " (gratuitous) ARP".
  ,  IP-     ARP-
.       Ethernet-.
     TCP/IP-c      ,  
 ,        
    ,        ARP-.  
          .  
,  " (gratuitous) ARP"  ,   
ARP,         ,  
  .

ARP  -             .
 ,  -   (),  
              
   Ethernet-   .         
            ,    
.   ,            -  
     ,        
      ()    .
            2      
    .      
   ,      .

    [--ICMP redirects--]

,          ARP,  
      ,     
ICMP,       ,  
     .    ICMP  (Internet  Control  Message
Protocol   -   RFC792)          
IP-         
   .             
       . 
                   ,
     ,   .  
         , 
         .       (
)          
    (forwarding).     
        
   (routing).             ,
        
     .       2-
,          ,   -
     .      
 route (route -n)  netstat -rn.

                (IP)  
        ,    .  
    ,     (
        Destination   0.0.0.0).   
    .      ,         
            , 
,          .
       (direct)   (indirect).
    ,          ,
  .        -  ,    
,            
.             .
  TCP       
(   TCP-).

 ( )   rtredirect(),
               
     .  
            
        ,      
   . ,    
               (  ),      
.            
     .      
           
    .       
  ICMP.          ICMP Redirect
Message  :

-------------------------------------------
| 8bit Type | 8bit Code | 16bit Checksum  |
-------------------------------------------
| 32 bit Gateway IP                       |
-------------------------------------------
| Internet Header + 64 bits of Datagram   |
-------------------------------------------

  : Type-5 (ICMP--Redirect), ode -
  0=Redirect datagrams for the Network
  1=Redirect datagrams for the Host
  2=Redirect datagrams for the Type of Service and Network
  3=Redirect datagrams for Type of Service and Host.

C   0  2    .
      1      ,    
                    
,   IP- ,     
(      Destination   IP-), 
  IP  ,        
  (        Gateway).    Type of
Service  (TOS)   IP-, ,    
     .     8 .
     , ,  ,
.   TOS            
          .    
            
,   TOS.

C   ICMP   Redirect   Message        
         
    .      (RFC)   
(     )  ,     
           
  .      ICMP-,    
    (      
   ,      
   ..)      
.

----------------- ,  . -------------------
    "TCP/IP  Illusrated"      4.4 BSD,
    ICMP-redirect      
  .      ( )
  .     :
1.       
.
2.            
 .
3.         
.
4.       .

  ,       2        
         ,            ICMP
        .       
      ,  
      .
--------------------------------------------------------------------------

  ICMP         . 
IP-          IP-        
  icmp_redir.c  . RFC,   
    ,  ,     
ICMP  redirect,     .     
  (    (vanilla) Linux 2.0.30,  
    2.0.29  2.0.31pre9  ).

ICMP  redirect        DoS. 
    ARP-,       . 
,              , 
          .  ,  -
  ICMP  redirects  (      ), 
         
  (    ,     ,     
    ).  -      
.

     , -, 
  IP  ,      , , -,
  ,    .

   -  IP  -   , 
             (traceroute
  IP    ).      
     ,      
    254   (O-  255-     
) ICMP Redirect   IP .

   -   ( IP) ,    
.           IP   
  Internet ( ,   ,
IRC-  ..)

,      "  " , 
     ICMP Redirect  
  ,       Linux 1.2.8,  Win95  
WinNT  4.0.      ( Linux   2.0.0 
CX/LAN/SX,    B1 UNIX),  ICMP Redirect.

----------------- ,  . -------------------
      ,           
BUGTRAQ        ,      .  ICMP redirect
         -             
,     .    
    (switched    )        
(      B),    ICMP 
        65000    . 
   *nix-           RAM.  
""       .
--------------------------------------------------------------------------

    [-- --]

ARP,          (
  - . ). LAN-, , 
      ,      . 
     ARP-   arp(8)
      -    ,    
,     .  M$-  arp-
   ,    ARP-   
  .  ,        ,   
  ,     ARP ,    
   . ,      
    ,  ICMP (  
route(1)   D   ).

,      ARP-   arp -a ( -an, 
   -).

      ARP-      10Base2 ().
,          "" , 
  ""      ,     
    (      ).

           ICMP-?   , 
           
 -   . -,   
        , 
     ICMP?  ,  
  ,           , 
   RFC1122.      .  Linux
        ,      
""  .    IRIX  6.2           
   icmp_dropdirects=1      systune.    
         ICMP redirect
  ().     Linux  
          ipchains  (ipfw,  iptables),  
  ICMP-      "
  Linux".         Linux  
           ICMP  Redirect      
-     :

    for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
        echo 0 > &f
    done;

       FreeBSD,     
 ICMP redirect   :

/etc/rc.conf icmp_drop_redirect="YES"

  ARP       IP- 
    .      DNS,  , 
  hostname-    IP-      
/etc/hosts            IP-    
-  (      ).    ,
        ARP. Ethernet-  
  .           ARP-
     . Ethernet-    
  ARP-,          ARP-   
   .      ,          ,
    .      MAC-  
/etc/ethers.           ARP- 
ARP-        -f  -s    ARP.  ,   
  Linux     Perl,  
  ARP-        . 
    ""  .

#!/usr/bin/perl
# by John Goerzen
#Program: forcehwaddr
#Program to run ARP to force certain tables.

#Specify filename to read from on command line, or read from stdin.

foreach(<>){             # For each input line...
    chomp;               # Strip if CR/LF
    if(/^#/) { next; }   # If it's a comment, skip it.
    if(((($host, $hw)=/\s*(.+?)\s+(\S+)\s*/)==2)&&
        !(/^#/)) {
        # The text between the slashes parses the input line as follows:
        # Ignore leading whitespace. (\s*)
        # Then, start matching and put it into $host($host,(.+?))
        # Skip over the whitespace after that (\s+)
        # Start matching. Continue matching until end of line or optional
        # trailing whitespace.

        # Then, the if checks to see that both a
        # host and a hardware address were matched.
        # (2 matches). If not, we skip the
        # line (assuming it is blank or invalid or something).
        # a poung sign; if so, ignore it (as a comment).

        # Otherwise, run the appropriate command:
        printf("Setting IP %-15s to hardware address %s\n",$host,$hw);
        system "/usr/sbin/arp -s $host $hw\n";
        }
}

       LINUX   arpwatch,  
 ARP-    MAC  IP-.  :
Arpwatch keeps track for ethernet/ip address pairings. It syslogs activity
and reports certain changes via email. Arpwatch uses pcap(3) to listen for
arp packets on a local ethernet interface.

,    UNIX    ARP Wrap,    
-       (telnet,  SSH).    
:
Arpwrap  is  a  tool  which attempts to detect ARP spoofing attacks before
executing a unix command (such as SSH or Telnet).
 Linux-    :
http://packetstormsecurity.org/linux/security/arpwrap.linux.180701.tgz
 Solaris-  :
http://packetstormsecurity.org/UNIX/security/arpwrap.solaris.190701.tar.gz

==========================================================================

:
  
send_arp.c
icmp_redir.c

Special Thanks:
1)      ..,  ..,  ..  dl 
    "  ",     
  .
2) .    "  UNIX"
3) XR        .
4) KMINT21     FreeBSD.

 :
1.  .:
http://www.securityfocus.com/data/library/arp_fun.txt
2.   ..,   ..,  .. -  "  ",
. , . , 1999 .
3.  . - "  UNIX",  BHV, 1997 .
4.  .  - "  Linux", 2000 .

[]2001 SOLDIER (  )

