ARP, a very simple protocol, consists of merely four basic message types:
1.An ARP Request. Computer A asks the network, "Who has this IP address?"
2.An ARP Reply. Computer B tells Computer A, "I have that IP. My MAC address is [whatever it is]."
3.A Reverse ARP Request (RARP). Same concept as ARP Request, but Computer A asks, "Who has this MAC address?"
4.A RARP Reply. Computer B tells Computer A, "I have that MAC. My IP address is [whatever it is]"
only local attackers can exploit ARP's insecurities. A hacker would need either physical access to your network, or control of a machine on your local network, in order to deliver an ARP Cache Poisoning attack. ARP's insecurities can't be exploited remotely.
Man in the Middle Attack
A hacker can exploit ARP Cache Poisoning to intercept network traffic between two devices in your network. For instance, let's say the hacker wants to see all the traffic between your computer, 192.168.0.12, and your Internet router, 192.168.0.1. The hacker begins by sending a malicious ARP "reply" (for which there was no previous request) to your router, associating his computer's MAC address with 192.168.0.12
Now your router thinks the hacker's computer is your computer.
Next, the hacker sends a malicious ARP reply to your computer, associating his MAC Address with 192.168.0.1
Now your machine thinks the hacker's computer is your router.
Finally, the hacker turns on an operating system feature called IP forwarding. This feature enables the hacker's machine to forward any network traffic it receives from your computer to the router.
Now, whenever you try to go to the Internet, your computer sends the network traffic to the hacker's machine, which it then forwards to the real router. Since the hacker is still forwarding your traffic to the Internet router, you remain unaware that he is intercepting all your network traffic and perhaps also sniffing your clear text passwords or hijacking your secured Internet sessions.
--
http://www.watchguard.com/infocenter/ed ... 135324.asp
--
Try the Cain&Able software, its in the downloads section
DNR
)
