Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On a normal data exchange of the address resolution protocol (ARP), which steps of the exchange are affected by the ARP Poisoning attack?

If anybody would be able to answer this or show me a link that can help, it'll be very much appreciated!

share|improve this question

closed as not a real question by Adnan, TildalWave, Scott Pack, Mark Davidson, NULLZ Jun 24 '13 at 21:50

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Homework question? –  schroeder Jun 24 '13 at 18:59

1 Answer 1

up vote 0 down vote accepted

In a normal exchange the machine looking for a MAC address will ask the network with a "Who Has 192.168.1.5" request and the machine that has that ip address will reply with it's MAC address "192.168.1.5 is at AA:AA:AA:AA:AA:AA" both machines will store the MAC address in their ARP cache for use later

In an ARP poisoning attack the attacker is sending "192.168.1.5 is at BB:BB:BB:BB:BB:BB" to the router and "192.168.1.1 is at BB:BB:BB:BB:BB:BB" to the victim. These are sent without a "Who Has" request and the victims will store them in their ARP cache for use later.

Here's a link to how arp spoofing works http://www.irongeek.com/i.php?page=security/arpspoof

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.