ARP Protocol, Default Gateway, and Network Communication

Address Resolution Protocol (ARP)

• ARP is a protocol used to determine the MAC address of a local device when its IPv4 address is known.
• MAC Address: A physical address used for communication between Ethernet network interface cards (NICs).
• IP Address: A logical address used to send packets from the source to the destination.
• Destination on Same Network: If the destination IP address is on the same network, the destination MAC address is the address of the destination device.
• Destination on Remote Network: If the destination IP address is on a remote network, the destination MAC address is the host's default gateway address.
• ARP Functions: Resolving IPv4 addresses to MAC addresses and maintaining a table of IPv4 to MAC address mappings.
• Router's Role in ARP: Routers examine the destination IPv4 address, de-encapsulate Layer 2 information, and encapsulate the IP packet in a new data link frame for the outgoing interface.
• Impact of ARP Requests: ARP requests can affect network and host performance and pose potential security risks.
• Domain Name System (DNS): Used to determine the IP address when given a domain name (e.g., www.example.com).
• Next-hop Device: The device the router determines as the next destination for the packet based on the destination IP address.
• De-encapsulation: The process where a router removes Layer 2 information from an Ethernet frame.
• Encapsulation: The process of wrapping an IP packet in a new data link frame for transmission.
• Ethernet Frame: A data packet containing both the MAC address and the data being transmitted over an Ethernet network.
• Local IPv4 Network: A network where devices can communicate directly using MAC addresses.
• Default Gateway: The device that routes traffic from a local network to destinations outside that network.
• PDU: Protocol Data Unit, a single unit of data at a specific layer of the network model.
• Ethernet NIC: Network Interface Card enabling device connection to an Ethernet network.
• Network Performance: The efficiency and speed of data transmission across a network.
• Security Risks of ARP: Potential vulnerabilities associated with ARP that can be exploited by attackers.
• IPv4 Address: 32-bit address identifying a device on a network.
• MAC Address Mapping: The association between an IPv4 address and its corresponding MAC address maintained by ARP.
• Communicating on a Local Network: The process of devices exchanging data directly using their MAC addresses within the same network.
• Communicating on a Remote Network: The process of sending data to a different network, requiring routing through a default gateway.
• ARP: Address Resolution Protocol, a protocol used to map an IPv4 address to a MAC address.
• ARP Table: A table in RAM that stores the mapping of IPv4 addresses to MAC addresses.
• ARP Request: A message sent by a device to determine the MAC address associated with a specific IPv4 address when no entry is found in its ARP table.
• ARP Reply: A response by the device with the target IPv4 address in response to an ARP request, providing the MAC address.
• IPv6 Neighbor Discovery: A process similar to ARP, using ICMPv6 messages for address resolution.
• ARP Cache Timer: A timer that removes ARP entries that have not been used for a specified period.
• ARP Cache: A temporary storage area holding IP-to-MAC address mappings for quick reference.
• ARP Spoofing Technique: A technique where a threat actor replies to an ARP request for an IPv4 address, such as the default gateway, with its own MAC address.
• ARP Reply Manipulation: A technique where the threat actor sends an ARP reply with its own MAC address, causing the receiver to add the wrong MAC address to its ARP table, and wrongly send packets to the attacker.
• ARP Table Modification: The receiver adding the wrong MAC address to its ARP table, sending packets to the threat actor instead of the intended recipient.
• IP Addresses: Used to identify the source and destination devices.
• MAC Addresses: Used for data link frame delivery from one network interface card (NIC) to another.
• ARP Functionality: Maps logical IPv4 addresses to Layer 2 MAC addresses.
• ARP Basic Functions: Resolving IPv4 addresses to MAC addresses and maintaining a table of IPv4 to MAC address mappings.
• ARP Process: Details how IP address resolution on a local network is done, including how devices search the table and send/receive requests/replies, When the destination is on the same network, the process sends the IPv4 address to all hosts to obtain the corresponding MAC address.
• ARP Table Search: Processes of searching the ARP tables to locate the destination IPv4 address if it's present on the same network as the source
• ARP Request: The process of sending an ARP request to determine the MAC address if the entry is missing in the ARP table.
• ARP Reply Response: the process of the intended device, with the correct IP address, responding to the ARP request with the corresponding MAC address.
• IPv6 Neighbor Discovery: Details how IPv6 handles neighbor discovery differently than using ARP, utilizing ICMPv6 messages.

Ethernet Frame

• Containing both the MAC address and the data transmitted.

Local Network

• A network where devices communicate directly without routing.

Animation of ARP Function

• Visual demonstration of ARP encapsulating packets into Ethernet frames.

ICMP Frames

• Internet Control Message Protocol frames, used for error messages and operational information in a network.

ARP Mapping Process

• Sequence of ARP request and reply to map IPv4 addresses to MAC addresses.

Operating System Differences

• Variations in ARP cache timer settings based on the operating system.

Demonstration of ARP Request

• Example of sending an ARP request to obtain the MAC address for a specific IPv4 address.

Demonstration of ARP Reply

• Example of a device responding to an ARP request with the correct MAC address.

ARP Broadcasts

• ARP requests are broadcast to every device on the local network.

Impact of ARP Broadcasts

• Minimal impact on typical business networks.

Performance Reduction

• Potential performance reduction if many devices access network services simultaneously.

ARP Learning

• Process by which devices learn and store MAC addresses in the ARP table.

ARP Spoofing

• A technique used by threat actors to reply to ARP requests with incorrect MAC addresses, potentially leading to security risks.

ARP Poisoning Attack

• A type of attack where ARP spoofing is used to perform an attack.

ARP Spoofing Technique

• Procedure involving a threat actor responding to an ARP request with a fake MAC address.

ARP Reply Manipulation

• A threat actor sending an ARP reply with its own MAC address, leading to incorrect MAC address mapping.

ARP Table Modification

• Receiver adding the incorrect MAC address to its ARP table.

IP Addresses

• Identifying the source and destination devices on the network.

MAC Addresses

• Delivering data link frames from one NIC to another on the same network.

ARP Functionality

• Mapping logical IPv4 addresses to Layer 2 MAC addresses.

ARP Basic Functions

• Resolving IPv4 to MAC addresses, maintaining IPv4-MAC mapping table.

ARP Process (in detail)

• Step-by-step description when the destination is on the same network; how the process sends the IPv4 address to all hosts to get the address.

ARP Table Search

• The mechanism to search the ARP table for a destination IP address.

ARP Request

• The action of sending an ARP request to determine the MAC address if not found in the table entry.

ARP Reply Response

• The process of replying with the corresponding MAC address to complete the address mapping.

IPv6 Neighbor Discovery

• Alternative method used by IPv6 to discover neighbors, using ICMPv6 messages.
• Details on IPv6 neighbor discovery compared to ARP.

This lesson explains how devices learn MAC addresses using ARP, the role of the default gateway in inter-network communication, and common network vulnerabilities. It covers ARP table function, stale entry removal, and ARP spoofing attacks, along with related network security risks and commands.