On a normal data exchange of the address resolution protocol (ARP), which steps of the exchange are affected by the ARP Poisoning attack?
If anybody would be able to answer this or show me a link that can help, it'll be very much appreciated!
closed as not a real question by Adi, TildalWave, Scott Pack, Mark Davidson, NULLZ Jun 24 '13 at 21:50
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.
In a normal exchange the machine looking for a MAC address will ask the network with a "Who Has 192.168.1.5" request and the machine that has that ip address will reply with it's MAC address "192.168.1.5 is at AA:AA:AA:AA:AA:AA" both machines will store the MAC address in their ARP cache for use later
In an ARP poisoning attack the attacker is sending "192.168.1.5 is at BB:BB:BB:BB:BB:BB" to the router and "192.168.1.1 is at BB:BB:BB:BB:BB:BB" to the victim. These are sent without a "Who Has" request and the victims will store them in their ARP cache for use later.
Here's a link to how arp spoofing works http://www.irongeek.com/i.php?page=security/arpspoof