TP-LINK TL-SG5428 User's Guide download pdf (Page 166)

the above figure shown, the attacker sends the fake ARP packets of Host A to Host B, and then

Host B will automatically update its ARP table after receiving the ARP packets. When Host B tries

to communicate with Host A, it will encapsulate this false destination MAC address for packets,

which results in a breakdown of the normal communication.

 Man-In-The-Middle Attack

The attacker continuously sends the false ARP packets to the Hosts in LAN so as to make the

Hosts maintain the wrong ARP table. When the Hosts in LAN communicate with one another, they

will send the packets to the attacker according to the wrong ARP table. Thus, the attacker can get

and process the packets before forwarding them. During the procedure, the communication

packets information between the two Hosts are stolen in the case that the Hosts were unaware of

the attack. That is called Man-In-The-Middle Attack. The Man-In-The-Middle Attack is illustrated in

the following figure.

Figure 11-12 Man-In-The-Middle Attack

Suppose there are three Hosts in LAN connected with one another through a switch.

Host A: IP address is 192.168.0.101; MAC address is 00-00-00-11-11-11.

Host B: IP address is 192.168.0.102; MAC address is 00-00-00-22-22-22.

Attacker: IP address is 192.168.0.103; MAC address is 00-00-00-33-33-33.

1. First, the attacker sends the false ARP response packets.

2. Upon receiving the ARP response packets, Host A and Host B updates the ARP table of

their own.

3. When Host A communicates with Host B, it will send the packets to the false destination

MAC address, i.e. to the attacker, according to the updated ARP table.

4. After receiving the communication packets between Host A and Host B, the attacker

processes and forwards the packets to the correct destination MAC address, which

makes Host A and Host B keep a normal-appearing communication.

5. The attacker continuously sends the false ARP packets to the Host A and Host B so as to

make the Hosts always maintain the wrong ARP table.

In the view of Host A and Host B, their packets are directly sent to each other. But in fact, there is a

Man-In-The-Middle stolen the packets information during the communication procedure. This kind

of ARP attack is called Man-In-The-Middle attack.

157

1 2 ... 161 162 163 164 165 166 167 168 169 170 171 ... 252 253

No comments

TP-LINK TL-SG5428 User's Guide Page 166