moncler vest women you may be in doubt

[nikeshoes6i]

Often see the recent forum on the issue ARP virus, so the ARP in the Google keyword search, Ao! Results from N more about these issues. Oh, I thirst for knowledge strong:), want to learn the knowledge under the ARP, so common in the current network ARP issues a summary. Now paste it, and we hope to discuss!
1.ARP ARP concept
before we talk about, or must first know the concept and principle of ARP, understanding the principles of knowledge and analysis in order to better deal with the problem to face.
1.1ARP conceptual knowledge
ARP, full AddressResolutionProtocol, the Chinese called Address Resolution Protocol, it works at the data link layer, in the contact layer and the hardware interface, while the upper to provide services.
IP data packets usually sent via Ethernet, Ethernet equipment does not recognize 32-bit IP address, which is 48-bit Ethernet address of the Ethernet data packet transmission. Therefore, we must convert the IP destination address Ethernet destination address. In Ethernet, a host to communicate directly with another host, you need to know the MAC address of the target host. But the goal is to get the MAC address it? It is available through the Address Resolution Protocol. ARP protocol is used for the network IP address resolves to the hardware address (MAC address) to ensure smooth communication.
1.2ARP works
First, each host buffer in its own ARP ARP to establish a list to that IP address and MAC address mapping. When the source host needs to send a packet to the destination host, it will first check whether there is a list of their ARP IP address of the corresponding MAC address, if there is to directly send packets to the MAC address; If not, local network segment to initiate a broadcast ARP request packets, the query corresponding to the destination host MAC address. This ARP request data package including the source host IP address, hardware address, and destination host IP address. All the host network received the ARP request, checks the destination IP packet and its own IP address is the same. If not identical to ignore this data packet; if the same, the host first MAC address of the sender's IP address and ARP added to your list, if the ARP table already exists in the IP information, then it is covered, and then to the source host sends an ARP response packet, it needs to tell each other that they are looking for MAC address; the source host receives the ARP response packet, it will be the destination host's IP address and MAC address to their ARP list, and use this information to start data transfer. If the source host has not received ARP response packet, said ARP query failed.
example:
A address is: IP: 192.168.10.1MAC: AA-AA-AA-AA-AA-AA
B's address is: IP: 192.168.10.2MAC: BB-BB- BB-BB-BB-BB
spoken according to the above principle, we briefly explain the process: A and B want to communicate, A need to know the Ethernet address of B, so A sends a broadcast ARP request (who is 192.168.10.2, please tell 192.168.10.1), when B receives the broadcast, to check themselves and their own line was found, and then to A sends a unicast ARP reply (192.168.10.2 in the BB-BB-BB -BB-BB-BB).
1.3ARP communication mode
communication mode (PatternAnalysis): In the network analysis, communication mode analysis is very important, different protocols and different applications will have a different mode of communication. More times, the same protocol in different enterprise applications will also appear in a different mode of communication. Under normal circumstances ARP mode of communication should be: request -> response -> request -> response, that is, should a question and answer.
2.
common types of ARP attacks personally think that in two common types of ARP attacks: ARP scanning and ARP spoofing.
2.1ARP scan (ARP request storm)
communication mode (possibly):
request -> request -> request -> request -> request -> request -> response -> ; request -> request -> request ...
Description:
network broadcast a large number of ARP request packets, almost all hosts on the network segment to scan. A large number of ARP requests broadcast may consume network bandwidth; ARP ARP scan is usually a prelude to attack.
there because (probably):
* virus program, listener, scanner.
* If you deploy the right network analysis software, may be we are only part of the mirror port on the switch, so a large number of ARP requests from connected and non-mirror port issued by other hosts.
* if the deployment is not correct, the ARP request broadcast packet and the switch is connected from other hosts.
2.2ARP cheating
ARP protocol is not only in the ARP request sent ARP reply was received. When the computer receives the ARP response packet, when the local ARP cache will be updated, the response of the IP and MAC addresses stored in the ARP cache. So in a network, someone sends a forged ARP their response, the network may be a problem. This may be the protocol designers had not taken into account!
2.2.1 Principles of
assume a deceptive network environment, there are three main networks, namely the host A, B, C. Host details as described below:
A address is: IP: 192.168.10.1MAC: AA-AA-AA-AA-AA-AA
B's address is: IP: 192.168.10.2MAC: BB-BB -BB-BB-BB-BB
C address is: IP: 192.168.10.3MAC: CC-CC-CC-CC-CC-CC
normal circumstances communication between A and C, but this B to A when sending a forged ARP their response, and this response data for the sender IP address is 192.168.10.3 (C's IP address), MAC address is the BB-BB-BB-BB-BB-BB (C The MAC address should have been CC-CC-CC-CC-CC-CC, there was forged.) When A receives B forged ARP reply, it will update the local ARP cache (A being cheated), then B to C was disguised. At the same time, B also sends an ARP reply to C, the response packet in the sender IP address four 192.168.10.1 (A's IP address), MAC address is the BB-BB-BB-BB-BB-BB (A's MAC address should have been is AA-AA-AA-AA-AA-AA), when C B forged ARP responses received will also update the local ARP cache (C has also been cheated), then B to masquerading as A. This host A and C have been deceived host B, A and C have been the data communication between a B. Host B can know what to say between them:). This is a typical ARP spoofing process.
Note: Under normal circumstances, ARP spoofing a party should be the gateway.
2.2.2
ARP spoofing both cases, there are two situations: one is cheating the host as a communication between the host data; another to be deceived directly off the host network.
The first is: stealing data (sniffer)
communication modes:
response -> response -> response -> response -> response -> request -> response -> Answer -> request -> response ...
Description:
This situation described above is typical of our ARP deception, cheating is cheating host to host to send a large number of forged ARP reply packet to cheat When the communication is successful both deceived himself as a Host parties at this time can be deceived normal communication, but in the communication process is cheater
there because (probably):
* Trojan
* sniff
* The second man deceive
: lead off net
communication mode:
answer -> Response -> Response -> Response -> Response -> Response -> Request ...
Description:
such cases is the process of ARP spoofing, cheater cheated only one party, such as B deceived the A, B not C but also to cheat, this is essentially A and B in the communication, so the A and C can not communicate, the other case may not exist is a cheater ######## address spoofing.
######## address for the fraud, the investigation is relatively difficult, here it is best to borrow the TAP device (Oh, this stuff seems a little expensive Le), respectively, one-way data flow analysis to capture!
there because (probably):
* Trojan
*
* the destruction of a number of network management software control
3.
protection methods commonly used search online now for the ARP attack protection problems is bound up and use of IP and MAC ARP protection software, also appeared with the router ARP protection. Oh, we come to understand the following three methods.
3.1 static binding
most common method is to do a static IP and MAC binding, the net has done to the host and the gateway IP and MAC binding.
fraud by ARP spoofing the rules of the dynamic real-time machine within the network, so we all set to a static ARP to resolve internal network PC's deception, but also at the gateway to the static IP and MAC binding, so Comparison of two-way binding only insurance.
Methods:
on each host IP and MAC address of static binding.
command, arp-s can be achieved
example:
successful in the PC if you set the above through the implementation of arp-a you can see related tips:
InternetAddressPhysicalAddressType
192.168.10.1AA-AA-AA-AA-AA-AAstatic (static)
General not binding, in the case of the dynamic:
InternetAddressPhysicalAddressType
192.168.10.1AA-AA-AA-AA-AA-AAdynamic (dynamic)
Description: There are a lot of the network host, 500, 1000 Taiwan ..., if we are to do so each static binding, the workload is very large. . . . This static binding, restart the computer after each time have to be re-in binding, although it could make a batch file, but still a pain!
3.2
currently using ARP protection software protection software on the ARP out of class more, and we use the more commonly used equipment is welcomed to the ARP ARP tools, Antiarp and so on. In addition to their own to detect ARP attacks, protection works by a certain frequency to the network broadcast the correct ARP information. Next we come to it simply two small tools.
3.2.1 welcomes the ARP tool
I used the tool, it has five functions:
A.IP / MAC list
select card. If you do not need to set a single card. If it is multi-connected within the network card to set the piece of card.
IP / MAC scan. This will scan all the machines in the current network's IP and MAC address. When you scan, including net operating normally, because after the ARP table will serve as a reference.
function after this form of support needed, if prompted not get IP or MAC, to explain the form here, there is no corresponding data.
B. ARP spoofing detection
this function within the network will detect whether there has been pretending to form PC's IP. You can set the IP to detect the main form which, for example, routers, movie servers, machines that require access to the machines within the network IP.
(added) the number of fraudulent messages sent;

this message means: the time at 22:22:22, detect fraud issued by the 192.168.1.22 message has been sent out 1433 times, he deceived the content of information sent is: 192.168.1.1 The MAC address is 00:0 e: 03:22:02: e8.
open detection, if there is IP-spoofing for the table, there will be prompt. Can be found within the network follow the prompts to the root of ARP spoofing. Tip one, any machine can impersonate another machine to send IP and MAC, so even suggest a certain IP or MAC spoofing message is sent, it may not be 100% accurate. Please do not all use of violence to solve some problems. Active Maintenance

C. This feature can be dropped directly address the problem of ARP spoofing, but not the ideal method. His principle of non-stop in the broadcast network established the correct IP-MAC address.
Frequency is the second contract the number of correct packet transmission network all the machines. Strongly recommended to minimize the broadcast IP, as little as possible of the radio frequency. General Settings 1 can, if the case is not bound IP, ARP spoofing occurs, you can set to 50-100 times that if there are dropped calls can be set higher, which can quickly solve the problem of ARP spoofing. But to really solve the ARP problem, or refer to the above binding.
D. Yan Yan to the router log
collection system to the router logs, and other functions.
E.
Ethereal network analysis software like Ethereal, save the format. cap.
3.2.1Antiarp
the software interface is simple, following is the collection of the software I use. Enter the gateway IP address
A., click on [to get gateway address] will show the gateway's MAC address. Click the [Auto-Protect can protect the gateway with the current communications network card will not be a third party monitoring. Note: In case of ARP spoofing tips, indicating that the attacker sends a packet to ARP spoofing packets for the network card, if you want to track the source of attack remember that the attacker's MAC address,gucci mens shoes, MAC address of the scanner can be used to find the corresponding IP the MAC address.
B. IP address conflict
such as IP address conflicts occur frequently, indicating that ARP spoofing attacks are frequently sent packets, IP conflict warning will appear, use AntiARPSniffer to prevent such attacks.
C. You need to know the MAC address conflicts, Windows will log these errors. View the specific methods are as follows:
Right-click [My Computer] - [Management] - Click [Event Viewer] - Click [System] - View Source is [TcpIP] --- Double-click the event can be seen Show address conflict, and record the MAC address, please copy the MAC address and MAC address of the local fill AntiARPSniffer input box (Please note that will: convert -), the input is complete click on the [address conflict prevention, in order for MAC commencement address and then disable the local network adapter card is enabled, the command line, type in CMD Ipconfig / all, see the current MAC address with the local MAC address MAC address matches the input box, if the change fails, please contact me. If successful,moncler vest women, will no longer display the address conflict.
Note: If you want to restore the default MAC address, click [Restore Defaults], in order to take effect, disable the local MAC address and then enable the network adapter card.
3.3 router with ARP protection
previously heard very little of these routers, the router for this type of protection referred to ARP, in fact, it works on a regular basis the right to send its own ARP information. However, this router features a real sense for the attack, it can not be resolved.
ARP feature is the most common dropped, under normal circumstances a period of time without treatment can restore normal Internet access, because the ARP spoofing is the aging time, over the aging time will automatically return to normal. Most routers are now kept in a very short period of time the correct ARP broadcast their information to the host cheated back to normal. But if there is ARP spoofing attack (in fact, a very short amount of time, a great deception ARP, 1 秒 have hundreds of thousands), it is constantly launching packets to prevent ARP spoofing machine within the network the Internet, even if the router continuously The package will also be broadcasting the correct number of error messages to his drowning.
you may be in doubt: we can send more and faster than the correct ARP cheater information ah? If an attacker to send 1,000 per ARP spoofing packets, then we send 1,500 per correct ARP information!
the face of the above questions, we think about it, if a large network topology, the network received a lot of network devices and hosts a large number of devices to deal with the broadcast message, that network to use,nike air max one, good bad mood, to say the Council affect our work and study. ARP broadcast will result in waste of network resources and occupation. If the network is a problem, we get caught analysis, data packets will also appear in many of these ARP broadcast packets, the analysis would have been affected.
Oh, knew so much,uggboots, may have said above will be incorrect and not enough places, hope a lot of discussion.other article


buy chi straightener 笑着说

discount chanel handbags 在这之前只要过程精彩就好

mbt shoes online 剪切