Gratuitous ARP

When ARP was designed, the Ethernet adapters were not reliable. Then, when a host had a new MAC address because its Ethernet adapter was replaced, it should have sent an unsolicited ARP reply to force an update on all ARP tables in the other hosts.

In Figure 6-3, host B changes its MAC address to 0000.BABE.0000 and sends an unsolicited ARP reply to the broadcast address FFFF.FFFF.FFFF to tell hosts on the Ethernet segment to change their <IP, MAC> binding for host B.

Figure 6-3 Unsolicited ARP Reply

2 is at BABE

0000.BABE.0000

0000.CAFE.0000

Host C IP: 10.0.0.3 MAC 0000.0666.0000

Host C IP: 10.0.0.3 MAC 0000.0666.0000

Upon receipt of the unsolicited ARP reply, host A updates its ARP table with the new <IP, MAC> address mapping for host B, as Table 6-2 shows.

Table 6-2 Host A ARP Table

IP Address	MAC Address
10.0.0.1	0000.CAFE.0000
10.0.0.2	0000.BABE.0000

From this point on, host A sends all IP packets for host B to the Ethernet address 0000.BABE.0000. The Ethernet switch only collects, understands, and acts on Layer 2 information; it is not at all impacted by the mapping <IP, MAC>. It just learned that 0000.BABE.0000 is now connected on the same port as 0000.C5C0.0000.

This unsolicited ARP reply is called gratuitous ARP. Not all IP hosts accept blindly gratuitous ARP (either by an incorrect implementation—not following the RFC 826—or by a deliberate choice of the implementer).

Continue reading here: Elements of an ARP Spoofing Attack

Was this article helpful?

0 0