Address Resolution Protocol - ARP

Not : Konuyla ilgili olarak Open Systems Interconnection başlıklı yazıya göz atabilirsiniz.

Giriş
Address Resolution Protocol IPv4 ile kullanılıyor. OSI katmanlarında Data Link Layer ile bir üst katman arasında dönüşüm yapmak için lazım. ARP sorgusu girdi olarak IP adresi alır, çıktı olarak MAC adresi verir.

ARP ve Subnet İlişkisi
ARP eğer IP paketi ethernet kartımızın ait olduğu subnete gidecekse kullanılır. Açıklaması şöyle.

When device A with IP address A needs to send a packet to device B with IP address B, the first thing it does is consulting its routing table to determine if IP address B belongs to a subnet it can directly reach through its network interface(s); if it does, then devices A uses ARP to map IP address B to a physical Ethernet address, and then sends an Ethernet frame to that address.

But if the two IP Addresses are on different subnets, the device will follow a completely different logic: it will look in its routing table for a route to the destination network, and then it will send its packet to the appropriate router (or to its default gateway if no more specific route is present); in this scenario, ARP will be used to find the hardware address of the router, because the destination IP address has already be deemed to not be directly reachable, so the packet must be delivered to a router which can take care of it.

Subnetleri örnek veren bir başka açıklama şöyle

If my computer has the IP 192.168.0.1 and the mask is 255.0.0.0 it means that any address from 192.0.0.0 to 192.255.255.255 is in the same subnet. The packets to all those other computers don't need to go through the router, they can be send directly. Send an ARP packet to get the MAC adddress of the destination computer and then send the packet.

But, if my computer has the IP 192.168.0.1 and the mask is 255.255.255.128 then the computers in the same subnet are from IP adddress 192.168.0.0 to 192.168.0.127 only. They can be reached directly (send ARP, find MAC address,etc.). Any other address, for example 192.168.0.200 must be reached passing through the router.

ARP ve Switch İlişkisi

Açıklaması şöyle

A switch has a MAC address table, not an ARP table like the hosts (except where it is a host for management purposes, but that has nothing to do with the switching function). While an ARP table can look up a layer-2 address from a layer-3 address, a switch MAC address table will look up a switch interface from a layer-2 address. Many people get this wrong.

If a switch doesn't have a layer-2 address in its MAC address table, then it will flood the frame to all interfaces, except the one where it entered the switch.

ARP ve Router İlişkisi
İki router birbiri ile haberleşmek için ARP kullanmaz. Genellikle başka bir Layer 2 protokol kullanılır. Açıklaması şöyle

There are layer-2 protocols that may use other, or no, addressing on the frames. If there is no addressing, e.g. PPP, then the router knows how to create the frame, and there is only one other device on the link, but there are many other layer-2 protocols (frame relay, ATM, etc.) that use other addressing, and a router will use a method other than ARP to resolve the layer-2 address of the next hop.

ARP ve Multicast İlişkisi
Multicast paketler IP çözümlemesi için ARP kullanmaz. Multicast adres, statik şekilde MAC adresine dönüştürülebilir. Açıklaması şöyle

Multicast does not use ARP. Multicast IP Address mapped statically into Multicast MAC.

ARP Spoofing

Açıklaması şöyle. Yani gerçek bir bilgisayarı taklit edersek arada bir paket kaçırabiliriz.

If there's no contention from the other hosts, ARP spoofing is fully reliable for all IP-based protocols. You do it once, the gateway thinks that you're the victim and the victim thinks that you're the gateway, and you have a reliable MitM position over which you can send TCP, UDP, ICMP, or anything else IP-based.

If there's contention from the other hosts and they try to re-assert the actual network topology, it doesn't matter what you're using on top of IP. Every so often, the mapping of IP to Ethernet (MAC) address will get changed, and you (the attacker) will be out of the loop. If a packet arrives / is sent during this time, it will bypass you.

The one place this might matter is if you're implementing a transparent proxy, terminating the TCP connection from the client (pretending to be the server) and starting a new one to the server. In that case, the sequence numbers on each side of you will be different, and without you in the loop, the connection will break. However, there's no need to do this; you can just modify the TCP stream bidirectionally without actually terminating it.

ARP Tipleri
Protokol sadece Request ve Reply olarak tanımlanmış ancak mesajlar şu amaçla kullanılıyor.

1. ARP Request
2. ARP Reply
3. Gratuitous ARP Request
4. Gratuitous ARP Reply
5. ARP Probe

Şimdi mesajlara bakalım.

1. ARP Request Nedir?
RF 826 An Ethernet Address Resolution Protocol -- or -- Converting Network Protocol Addresses
to 48.bit Ethernet Address for Transmission on Ethernet Hardware'deki açıklaması şöyle

Packet Generation:

As a packet is sent down through the network layers, routing determines the protocol address of the next hop for the packet and on which piece of hardware it expects to find the station with the immediate target protocol address. In the case of the 10Mbit Ethernet, address resolution is needed and some lower layer (probably the hardware driver) must consult the Address Resolution module (perhaps implemented in the Ethernet support module) to convert the pair to a 48.bit Ethernet address. The Address Resolution module tries to find this pair in a table. If it finds the pair, it gives the corresponding 48.bit Ethernet address back to the caller (hardware driver) which then transmits the packet. If it does not, it probably informs the caller that it is throwing the packet away (on the assumption the packet will be retransmitted by a higher network layer), and generates an Ethernet packet with a type field of ether_type$ADDRESS_RESOLUTION. The Address Resolution module then sets the ar$hrd field to ares_hrd$Ethernet, ar$pro to the protocol type that is being resolved, ar$hln to 6 (the number of bytes in a 48.bit Ethernet address), ar$pln to the length of an address in that protocol, ar$op to ares_op$REQUEST, ar$sha with the 48.bit ethernet address of itself, ar$spa with the protocol address of itself, and ar$tpa with the protocol address of the machine that is trying to be accessed. It does not set ar$tha to anything in particular, because it is this value that it is trying to determine. It could set ar$tha to the broadcast address for the hardware (all ones in the case of the 10Mbit Ethernet) if that makes it convenient for some aspect of the implementation. It then causes this packet to be broadcast to all stations on the Ethernet cable originally determined by the routing mechanism.

ARP Request IP Adresine sahip MAC numarasını bulmak için kullanılır. İçi şuna benzer.

Hardware Type : Ethernet (1)
Protocol Type : IP (0x800)
Hardware Size : 6
Protocol Size : 4
Opcode : Request (1)
Sender MAC Address : 30:d9:2b:x:x:x
Sender IP Address : 10.0.15.141
Target MAC Address : 0:0:0:0:0:0
Target IP Address : 10.0.15.190

Bu mesaj şu anlama gelir.
"Who has 10.0.15.190 Tell 10.0.15.141"

ARP Request'i Ethernet'e broadcast edilir. ARP Request mesajını duyan bir PC mesajın kimden geldiğini anlasa bile, Arp tablosunu satır eklememelidir. Açıklaması şöyle

The workstations aren't generally going to be talking to each other (and therefore have 100 useless entries in a table); they will be mainly talking to a mainframe, file server or bridge, but only to a small number of other workstations (for interactive conversations, for example). The protocol described in this paper distributes information as it is needed, and only once (probably) per boot of a machine.

Not : Bazı ARP Request mesajlarında Target MAC Address 0:0:0:0:0:0 yerine  FF:FF:FF:FF:FF:FF ile de dolu gelebilir.

2. ARP Reply Nedir?
ARP Reply sorgulanan IP Adresine sahip MAC numarasını bildirir. İçi şuna benzer.

Hardware Type : Ethernet (1)
Protocol Type : IP (0x800)
Hardware Size : 6
Protocol Size : 4
Opcode : Reply (2)
Sender MAC Address : 00:16:17:x:x:x
Sender IP Address : 10.0.15.190
Target MAC Address : 30:d9:2b:x:x:x
Target IP Address : 10.0.15.141

Bu mesaj şu anlama gelir.
"10.0.15.190 is at  00:16:17:x:x:x"

ARP Reply belli bir bilgisayara adreslidir.

Bazı kaynaklarda ARP Reply mesajındaki "Sender IP Address" ile "Target IP Address" alanları aynı değere sahip olmalı gibi anlatılıyor. Benim verdiğim örnekte ise böyle değil. Aslında sanırım her iki yöntem de doğru.  Karışıklık RFC'deki şu cümleden kaynaklanıyor

Swap hardware and protocol fields, putting the local hardware and protocol addresses in the sender fields.

3 ve 4. Gratuitous ARP Nedir?
Bir ağ arayüzü keyfi olarak IP adresini ve kullandığı MAC adresini yayınlayabilir. Buna keyfi/sebepsiz ARP denir. Bu mesaj broadcast edilir.

NIC Bonding'i failover şeklinde kullanılırken, devreye giren ethernet kartı diğer kartın MAC numarasını kullanabilir veya Gratuitous ARP yayınlayarak paketlerin kendisine gelmesini sağlar.

Mesaj tuhaf bir şekilde ARP Request veya ARP Reply olarak yayınlanabilyor. Eğer Request ise normal Request mesajından ayırabilmenin tek yolu Sender IP Address ve Target IP Address alanlarının aynı olup olmadığına bakmak.

Request mesajının içi şuna benzerr.

Hardware Type : Ethernet (1)
Protocol Type : IP (0x800)
Hardware Size : 6
Protocol Size : 4
Opcode : Request (1)
Sender MAC Address : 00:16:17:x:x:x
Sender IP Address : 10.0.15.190
Target MAC Address : 0:0:0:0:0:0
Target IP Address : 10.0.15.190

Eğer Reply ise normal Reply mesajından ayırabilmenin tek yolu Sender MAC Address ve Target MAC Address veya Sender IP Address ve Target IP Address alanlarının aynı olup olmadığına bakmak.

Reply mesajının içi şuna benzer.

Hardware Type : Ethernet (1)
Protocol Type : IP (0x800)
Hardware Size : 6
Protocol Size : 4
Opcode : Reply (2)
Sender MAC Address : 00:16:17:x:x:x
Sender IP Address : 10.0.15.190
Target MAC Address : 00:16:17:x:x:x
Target IP Address : 10.0.15.190

5. Directed ARP Nedir?

Belli bir MAC adresine gönderilen ARP'tır. Normalde ARP mesajları broadcast edilir. Ancak bu ARP Mesajının amacı ARP Tablosundaki değerlerin halen geçerli olup olmadığını bulmaktır. Yani ARP Cache Validation. Açıklaması şöyle

IMPLEMENTATION: Four mechanisms have been used, sometimes in
combination, to flush out-of-date cache entries.

[...]

(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the
timeout should be on the order of a minute, and typically N is 2.

Mesela bilgisayarımız Gateway'in halen orada olup olmadığını belirlemek için böyle bir ARP gönderebilir. Directed olduğu için ağdaki herkesi meşgul etmez.

ARP Cache
Açıklaması şöyle

Windows uses 30 seconds for ARP cache timeout.

ARP Proxy Nedir?

Fiziksel olarak farklı iki ağı birbirine bağlamak için ARP Proxy kullanılır. Proxy ARP Request mesajına diğer ağdaki makine adına ARP Reply ile cevap verir. Daha sonra gelen paketleri yakalar ve diğer ağa gönderir. ARP Proxy hemARP Reply mesajının Sender MAC Address alanına içine hem de Ethernet paketinin Source MAC Address alanına adına cevap verdiği MAC Adresini yazar.

arp Komutu

arp komutu yazısına taşıdım.

arping Komutu
arping komutu yazısına taşıdım.

Neighbor Discovery Protocol
Neighbor Discovery Protocol yazısına taşıdım