ARP Considerations
ARP is designed to map IP addresses to MAC addresses. It was also, like most protocols still used in IP networking today, designed at a time when everyone on a network was supposed to be reasonably trustworthy. As a result, the protocol is designed around efficiently executing its task, with no provisions for dealing with malicious use. At a basic level, the protocol works by broadcasting a packet requesting ■ MAC address that owns a particular IP address. All devices on a LAN will see the request, but only the device that uses the IP address will respond.
From a security standpoint, there is a major limitation in ARP. ARP has no notion of IP address ownersh This means any MAC address can masquerade as any IP address provided an attacker has the right software tool to execute the attack. Furthermore, there is a special type of ARP broadcast called a gratuitous ARP (gARP). A gARP message tells all hosts on a LAN, without having been asked, what its IPMAC binding is.
gARP is used in several legitimate ways. The most prevalent is in high-availability situations in which two systems share the same IP address but have different MAC addresses. When the primary system changes, it must notify the rest of the LAN of the new MAC address with which to contact the primary host. ARP is also used to prevent IP address conflicts. Most modern OSs send an ARP request out for the address with which they are configured when they boot. If a machine responds, they know that another node is already using their configured IP address, and the interface should be shut down until the conflict can be resolved.
Consider the following sequence outlined in Figure 6-8.
Figure 6-8. Misuse of gARP
Figure 6-8. Misuse of gARP
In the figure, a host that is not the router is sending gARP broadcasts claiming to be the router's IP address but using its own MAC address. Hosts 2 and 3 generally ignore such a broadcast if they haven't yet communicated with the router. When they finally do, they send an ARP request for the router's MAC address. The real router (.1) will respond, but as soon as host 4 sends the next gARP broadcast claiming to be .1, hosts 2 and 3 will update their ARP entry for .1 to reflect host 4's MAC address (MAC D).
At this point, the traffic destined off of the 10.2.3.0/24 network will go to host 4's MAC address. That he could then send it to the real router, drop the traffic, sniff the traffic, or modify the contents of a packet and send it along to the real router.
Then all traffic from the hosts flows through the attacker's machine before arriving at the actual router. desired, the attacker could also send gARP broadcasts to the router claiming to be every host on the loc LAN, which allows the attacker to see the return traffic as well.
The attack described in the preceding paragraphs is the core problem with ARP. The attack described is generally referred to as ARP redirection or spoofing. Any host on the LAN can attempt to masquerade a: any other host through the use of ARP and gARP messages.
dsniff is a collection of tools written by Dug Song to launch and further take advantage of this attack. Fo example, after launching the ARP spoofing attack, dsniff has a special sniffer designed to find and outpu to a file the usernames and passwords of dozens of common protocols. It even goes so far as to execute man-in-the-middle (MITM) attacks against Secure Sockets Layer (SSL) and SSH by presenting false credentials to the user. By using this attack, it becomes possible for an attacker to learn sensitive information sent over encrypted channels. More information on dsniff can be found at the dsniff website http://monkey.org/~dugsong/dsniff/.
Mitigating ARP redirection attacks is a bit trickier. You could use private VLANs (PVLANs) as described la in this section, but this would prevent all host-to-host communication, which isn't particularly good for a network (except in specific cases such as server farms). A feature available in some Cisco switches is called ARP inspection. ARP inspection allows VLAN ACLs (VACLs) to be applied to ARP traffic flowing acro a specific VLAN on the switch. A common way these VACLs are used is to make sure the MAC address o the default gateway does not change. The following ACL restricts ARP messages for two MACIP bindings and prevents any other MAC address from claiming ownership for those two IPs:
CatOS> (enable) set security acl ip 192.0.2.1 00-d0-b7-11-13-14 CatOS> (enable) set security acl ip 192.0.2.1 any log
CatOS> (enable) set security acl ip 192.0.2.2 00-d0-00-ea-43-fc CatOS> (enable) set security acl ip 192.0.2.2 any log
CatOS> (enable) set security acl ip CatOS> (enable) set security acl ip CatOS> (enable) commit security acl
ACL-95 permit arp-inspection host
ACL-95 deny arp-inspection host
ACL-95 permit arp-inspection host
ACL-95 deny arp-inspection host
ACL-95 permit arp-inspection any any
ACL-95 permit ip any any
ACL-95
As you can see, you must first permit the explicit binding. Then you deny any other ARP packets for tha same IP. Finally, you permit all other ARP packets.
There are some caveats to ARP inspection as it is currently implemented, and the management burden tracking MAC address and IP bindings for ACL entries probably prevents many system administrators fr< using this for anything other than default gateways and critical systems. For more information on ARP inspection, see the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/sw 7 5/confg gd/acc list.htm#102067
You can also limit on a per-port basis the number of ARP packets that are processed by the switch. Exce packets are dropped and can optionally cause the port to shut down. This can stop really noisy ARP attacks, but most ARP tools are less noisy than this. Arpspoof, for example, sends less than one ARP message per second. The following example sets an inspection limit of 25 packets per second and a shutdown threshold of 50 packets per second for port 2/1.
CatOS> (enable) set port arp-inspection 2/1 drop-threshold 25 shutdown-threshold 50
Drop Threshold=25, Shutdown Threshold=50 set on port 2/1. CatOS> (enable)
CatOS> (enable) show port arp-inspection 3/1
Port Drop Threshold Shutdown Threshold
2/1 2S S0
Keep in mind that, when systems initialize, they might send large numbers of legitimate ARP queries. U: this feature with caution, especially considering it won't stop the ARP attacks used today. If you deploy ARP inspection, be sure to use the VACLs as your primary means of defense and the ARP rate limiting t( stop clearly nonstandard behavior.
Other methods that can help include hard-coding static ARP entries for key devices in your network. Frc a management standpoint, you'd never be able to do this for all hosts, but for key devices it might be worth the effort.
Unfortunately, some older Microsoft operating systems (OSs) allow a static ARP entry to be overwritten by a gARP broadcast.
Open source tools can be used to help as well: arpwatch is a free tool developed by Lawrence Berkeley National Lab (LBNL). It works by keeping track of IP and MAC address bindings on the network and can notify you when certain mappings change. The tool can be downloaded here: http://www-nrg.ee.lbl.gov
Last, some IDS tools have the ability to detect certain types of ARP attacks. Some look for large quantit of ARP traffic, while others operate in much the same way as arpwatch.
Continue reading here: DHCP Considerations
Was this article helpful?