TL-SL3428_V3_User_Guide - TP-Link

11.2 ARP InspectionAccording to the ARP Implementation Procedure stated in 11.1.3 ARP Scanning, it can be foundthat ARP protocol can facilitate the Hosts in the same network segment to communicate with oneanother or access to external network via Gateway. However, since ARP protocol is implementedwith the premise that all the Hosts and Gateways are trusted, there are high security risks duringARP Implementation Procedure in the actual complex network. Thus, the cheating attacks againstARP, such as imitating Gateway, cheating Gateway, cheating terminal Hosts and ARP FloodingAttack, frequently occur to the network, especially to the large network such as campus networkand so on. The following part will simply introduce these ARP attacks.‣ Imitating GatewayThe attacker sends the MAC address of a forged Gateway to Host, and then the Host willautomatically update the ARP table after receiving the ARP response packets, which causes thatthe Host can not access the network normally. The ARP Attack implemented by imitating Gatewayis illustrated in the following figure.Figure 11-9 ARP Attack - Imitating GatewayAs the above figure shown, the attacker sends the fake ARP packets with a forged Gatewayaddress to the normal Host, and then the Host will automatically update the ARP table afterreceiving the ARP packets. When the Host tries to communicate with Gateway, the Host willencapsulate this false destination MAC address for packets, which results in a breakdown of thenormal communication.‣ Cheating GatewayThe attacker sends the wrong IP address-to-MAC address mapping entries of Hosts to theGateway, which causes that the Gateway can not communicate with the legal terminal Hostsnormally. The ARP Attack implemented by cheating Gateway is illustrated in the following figure.148