prinaha（prinaha）.docVIP

prinaha（prinaha） ULA0201 ARP A TCP/IP B [application layer] [data] [transport layer] [data] [port] [network layer] [data] [IP] [data link layer] [data] [IP] [MAC] [MAC] HWaddr 00:E0:4C:39:61:54 AB [network layer] To access BIP, we must first know BMAC. ARP 1, first check the ARP buffer pool, if you have, if not, then broadcast (range LAN exchange). 2, A-IP asked: May I ask who is BIP, please tell AIP. 3, BIP: Check whether A - IP has MAC (CACHE) and build cache (ARP pool). RPM -ivh wireshark-* libsmi-0.4.5-2.el5.i386.rpm The RealtekS_39:61:54 Elitegro_72:89:b7 ARP Who has 32 Tell 34 Elitegro_72:89:b7 RealtekS_39:61:54 ARP 32 is at 00:19:21:72:89:b7 Bedroom is often malicious speed limit: Gateway GW_IP GW_MAC A_IP, B_IP, C_IP (destruction) (GW_ip, GW_MAC) to send the packet, constantly refresh the ARP pool. Black finish (GW_IP, -C_MAC) Solve： Fixed IPMAC ARP -s 08 00:B0:C4:01:28:D4 Multiple stabilization: 1. Collect MAC and IP Nmap -sP /24 2, cat /etc/ethers 00:1F:D0:C3:2B:2A 3, ARP -f ARP -f saves rc.local Attack simulation 1. Prepare the gateway, configure the inside and outside IP on the gateway. 2, A client, attack machine, monitor ARP address pool change Of. - Watch - N 1, ARP, -n 3, B client, masquerading gateway. (open firewall speed limit) - - iptables - A FORW ARD - s A_ip - M limit - limit 10/m - J ACCEPT - - iptables - A FORW ARD - s A_ip - J DROP 4, C clients, attack machines, listening packets. - - arpattack - t arpdeceive - I eth0 - O A_ip - a GW_ip - S B_ip - tcpdump -nn Normal: GW_IP | \ \ A_IP B_IP C_IP After being attacked: GW_IP \ \ A_IP B_IP C_IP GW_IP:08 00:B0:C4:01:28:D4 B_IP:23 00:1F:C6:76:26:26 A_IP:38 00:23:54:6A:18:C5 C_IP:34 00:E0:4C:39:61:54 data link layer Ether (Ethernet) PC -PPP- cat 56kbps - Internet - answer - pass - network PPP PPPoE Ethernet PC (NIC) - RJ45 ADSL cat PPPOEServer: Characteristic： Application: Rp-pppoe-3.5-32.1.i386.rpm Ppp-2.4.4-2.el5.i386.rpm /etc/ppp/ Chap-secrets No password transfer Pap-secrets: Transfer user nam