You're reading from Network Protocols for Security Professionals

Product type Book

Published in Oct 2022

Publisher Packt

ISBN-13 9781789953480

Pages 580 pages

Edition 1st Edition

Languages

Python

Concepts

Network Security

Authors (2):

Yoram Orzach

Deepanshu Khanna

View More author details

Table of Contents (23) Chapters

Preface

1. Part 1: Protecting the Network – Technologies, Protocols, Vulnerabilities, and Tools

2. Chapter 1: Data Centers and the Enterprise Network Architecture and its Components

3. Chapter 2: Network Protocol Structures and Operations

4. Chapter 3: Security Protocols and Their Implementation

5. Chapter 4: Using Network Security Tools, Scripts, and Code

6. Chapter 5: Finding Protocol Vulnerabilities

7. Part 2: Network, Network Devices, and Traffic Analysis-Based Attacks

8. Chapter 6: Finding Network-Based Attacks

9. Chapter 7: Detecting Device-Based Attacks

10. Chapter 8: Network Traffic Analysis and Eavesdropping

11. Chapter 9: Using Behavior Analysis and Anomaly Detection

12. Part 3: Network Protocols – How to Attack and How to Protect

13. Chapter 10: Discovering LAN, IP, and TCP/UDP-Based Attacks

14. Chapter 11: Implementing Wireless Network Security

15. Chapter 12: Attacking Routing Protocols

16. Chapter 13: DNS Security

17. Chapter 14: Securing Web and Email Services

18. Chapter 15: Enterprise Applications Security – Databases and Filesystems

19. Chapter 16: IP Telephony and Collaboration Services Security

20. Assessments

21. Index

Why subscribe?

22. Other Books You May Enjoy

L3- and ARP-based attacks

In this section, we will discuss ARP and IP attacks. Let's start with ARP poisoning, which is also known as ARP spoofing.

ARP poisoning

ARP is a protocol that resolves the destination MAC address from the destination IP address. Note that we discussed this in Chapter 2, Network Protocol Structures and Operations.

ARP poisoning (also known as ARP spoofing) is a type of attack that involves sending malicious ARP packets to a default gateway on a LAN in order to change the gateway ARP table.

The attack is used to alter the host-under-attack MAC address in the gateway ARP cache. This is so that instead of sending packets to the host under attack, the gateway will send these packets to the attacker that can copy their content.

Once the default gateway has changed its ARP cache with the faulty MAC entry, all of the traffic sent to the host under attack travels through the attacker's computer, allowing the attacker to inspect or modify it...