Operation Manual

232
Figure 13-12 ARP Attack – Cheating Terminal Hosts
As the above figure shown, the attacker sends the fake ARP packets of Host A to Host B, and
then Host B will automatically update its ARP table after receiving the ARP packets. When Host
B tries to communicate with Host A, it will encapsulate this false destination MAC address for
packets, which results in a breakdown of the normal communication.

Man-In-The-Middle Attack
The attacker continuously sends the false ARP packets to the Hosts in LAN so as to make the
Hosts maintain the wrong ARP table. When the Hosts in LAN communicate with one another,
they will send the packets to the attacker according to the wrong ARP table. Thus, the attacker
can get and process the packets before forwarding them. During the procedure, the
communication packets information between the two Hosts are stolen in the case that the
Hosts were unaware of the attack. That is called Man-In-The-Middle Attack. The
Man-In-The-Middle Attack is illustrated in the following figure.
Figure 13-13 Man-In-The-Middle Attack
Suppose there are three Hosts in LAN connected with one another through a switch.
Host A: IP address is 192.168.0.101; MAC address is 00-00-00-11-11-11.
Host B: IP address is 192.168.0.102; MAC address is 00-00-00-22-22-22.
Attacker: IP address is 192.168.0.103; MAC address is 00-00-00-33-33-33.
1. First, the attacker sends the false ARP response packets.
2. Upon receiving the ARP response packets, Host A and Host B updates the ARP table of
their own.
3. When Host A communicates with Host B, it will send the packets to the false destination
MAC address, i.e. to the attacker, according to the updated ARP table.
4. After receiving the communication packets between Host A and Host B, the attacker
processes and forwards the packets to the correct destination MAC address, which makes
Host A and Host B keep a normal-appearing communication.
5. The attacker continuously sends the false ARP packets to the Host A and Host B so as to
make the Hosts always maintain the wrong ARP table.