Noncompliant Equipment - GIAC

Address Resolution Protocol (ARP)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: Request
Sender hardware address: 00-03-4f-00-15-20
Sender IP address: 0.0.0.0
Target hardware address: 00-ff-ff-ff-ff-ff
Target IP address: 0.0.0.0
There seems to be a bug in the ARP implementation that causes it to address the Target hardware
address as 00-ff-ff-ff-ff-ff, instead of 00-00-00-00-00-00, which is what it should be if the target
hardware address is not known to the device. 00-ff-ff-ff-ff-ff seems to be the fiber channel arp
destination broadcast address referenced in RFC 4338.
There is no way to predict what, if anything, this bug will do; however, it is cause for concern, and we
need to remember that the device is not equipped with a serial line to recover it if the IP
implementation fails. In fact, according to the manufacturer, this device is not even equipped with a
hard reset feature by which the default firmware can be recovered. It is accessible only through its
connection to the alarm panel.
Although the device is primarily intended to be configured through the hard-wired connection to the
alarm panel, it cannot be supported by the skill set of the alarm installer and is not designed with the
requirements of the IT group in mind.
Another feature of the device is the capability to use the persistence of a TCP/IP connection as a means
of signal circuit supervision. The Central Station alarm receiver can detect an offline condition and
raise an alarm as protection against line-cut. The known failure of this device is a manifestation of the
buggy ARP implementation, which periodically scrambled the MAC address in the reply packet,
causing the device to stop communicating. Of course, the offline conditions were blamed on the
network.
The device does not support ICMP, and overall, this device is a problem waiting to happen.
The manufacturer appears to have learned from the mistakes of the first device, and examination of a
later model of a similar product is more encouraging, although a review of documentation discloses
nothing about the IP stack, either in the A&E specification or in the 48-page manual. At least, this
device has the MAC address documented on the device.