ARP Spoofing Attack
ARP 偽造攻擊
In normal ARP operation, a host sends a broadcast to determine the MAC address of a destination host with a particular IPv4 address. The device with the IPv4 address replies with its MAC address. The originating host caches the ARP response, using it to populate the destination MAC address in frames that encapsulate packets sent to that IPv4 address. By spoofing an ARP reply from a legitimate device with a malicious ARP reply, an attacking device appears to be the destination host that is sought by the sender. The ARP message from the attacker causes the sender to store the MAC address of the attacking system in its ARP cache. All packets that are destined for that IPv4 address are forwarded to the attacker system.
在正常 ARP 運作中，主機會發送廣播以確認具有特定 IPv4 位址之目的地主機的 MAC 位址。擁有該 IPv4 位址的裝置會以其 MAC 位址回覆。發起主機會快取該 ARP 回應，並用它來填入封裝了送往該 IPv4 位址之封包的框架中的目的地 MAC 位址。攻擊裝置藉由偽造來自合法裝置的 ARP 回應，使自己看起來就是傳送端所要尋找的目的地主機。來自攻擊者的 ARP 訊息會使傳送端將攻擊系統的 MAC 位址儲存在其 ARP 快取中。所有送往該 IPv4 位址的封包都會被轉送到攻擊系統。
An ARP spoofing attack, also known as ARP cache poisoning, can result in a man-in-the-middle situation. In the figure below, the Attacker on Host B tricks both Host A and its default gateway Router C. Host A sends traffic to Host B instead of the gateway and the gateway sends traffic to host B instead of Host A. The attacker on Host B can passively collect data from the packets before forwarding them on to their correct destination. The attacker can also actively allow, deny, and insert data as a man-in-the-middle.
ARP 偽造攻擊，又稱為 ARP 快取污染，可能導致中間人攻擊情況。在下圖中，Host B 上的攻擊者同時欺騙 Host A 及其預設閘道 Router C。Host A 將流量傳送給 Host B 而非閘道，閘道也將流量傳送給 Host B 而非 Host A。Host B 上的攻擊者可以在將封包轉送到正確目的地之前，被動地收集封包中的資料。攻擊者也可以主動地允許、拒絕，並以中間人身分插入資料。
ARP Spoofing Attack Sequence
ARP 偽造攻擊序列
Step 步驟 | Description 說明 |
1. 1. | Host A sends an ARP request for the Router C MAC address. Host A 發送 ARP 請求以取得 Router C 的 MAC 位址。 |
2. 2. | Router C replies with its MAC and IPv4 address. Router C 以其 MAC 位址及 IPv4 位址回覆。 |
3. 3. | Router C updates its ARP cache. Router C 更新其 ARP 快取。 |
4. 4. | Host A binds the Router C MAC address to its IPv4 address in the ARP cache. Host A 在 ARP 快取中將 Router C 的 MAC 位址與其 IPv4 位址綁定。 |
5. 5. | Host B (attacker) sends unsolicited ARP messages to Host A, binding the MAC address of Attacker B to the IPv4 address of Router C. Host B（攻擊者）向 Host A 發送未經請求的 ARP 訊息，將攻擊者 B 的 MAC 位址與 Router C 的 IPv4 位址綁定。 |
6. 6. | Host A updates its ARP cache with the MAC address of Attacker B bound to the IP address of Router C. Host A 更新其 ARP 快取，將攻擊者 B 的 MAC 位址與 Router C 的 IP 位址綁定。 |
7. 7. | Host B (attacker) sends unsolicited ARP messages to Router C, binding the MAC address of Host B to the IPv4 address of Host A. Host B（攻擊者）向 Router C 發送未經請求的 ARP 訊息，將 Host B 的 MAC 位址與 Host A 的 IPv4 位址綁定。 |
8. 8. | Router C updates its ARP cache with the MAC address of Host B bound to the IPv4 address of Host A. Router C 更新其 ARP 快取，將 Host B 的 MAC 位址與 Host A 的 IPv4 位址綁定。 |
9. 9. | Packets between Host A and Router C are now diverted through the attacker (B). Host A 與 Router C 之間的封包現在會被轉向經過攻擊者（B）。 |
Mitigating the ARP Spoofing Attack
緩解 ARP 偽造攻擊
To prevent ARP spoofing, or "poisoning," a switch can inspect transit ARP traffic to ensure that only valid ARP requests and responses are relayed. The ARP inspection feature of Cisco Catalyst switches prevents ARP spoofing attacks by intercepting and validating all ARP requests and responses. Each intercepted ARP reply is verified for valid MAC-to-IPv4 address bindings before it is forwarded. ARP replies with invalid MAC-to-IPv4 address bindings are dropped.
為防止 ARP 偽造（或稱「污染」），交換器可以檢查傳輸中的 ARP 流量，確保只有有效的 ARP 請求與回應會被轉送。Cisco Catalyst 交換器的 ARP 檢查功能藉由攔截並驗證所有 ARP 請求與回應，防止 ARP 偽造攻擊。每個被攔截的 ARP 回應在轉送前都會驗證其 MAC 對 IPv4 位址綁定是否有效。具有無效 MAC 對 IPv4 位址綁定的 ARP 回應會被丟棄。
Dynamic ARP Inspection (DAI) can determine the validity of an ARP reply based on bindings that are stored in a DHCP snooping database. In non-DHCP environments, DAI can validate ARP packets against user-configured ARP ACLs for hosts with statically configured IPv4 addresses.
動態 ARP 檢查（DAI）可以根據儲存在 DHCP 窺探資料庫中的綁定資訊，判斷 ARP 回應是否有效。在非 DHCP 環境中，DAI 可以針對具有靜態設定 IPv4 位址的主機，依使用者設定的 ARP ACL 來驗證 ARP 封包。
DAI associates each interface with a trusted state or an untrusted state. To ensure that only valid ARP requests and responses are relayed, DAI takes these actions:
DAI 會將每個介面關聯為信任狀態或不信任狀態。為確保只有有效的 ARP 請求與回應會被轉送，DAI 會採取以下動作：
- Forwards ARP packets received on a trusted interface without any checks.在信任介面上收到的 ARP 封包會不經任何檢查直接轉送。
- Intercepts all ARP packets on untrusted ports.攔截不信任連接埠上的所有 ARP 封包。
- Verifies that each intercepted packet has a valid MAC-to-IPv4 address binding before updating the local ARP cache or before forwarding the packet to the appropriate destination.在更新本地 ARP 快取或將封包轉送到適當目的地之前，驗證每個被攔截的封包是否具有有效的 MAC 對 IPv4 位址綁定。
- Drops ARP packets with invalid MAC-to-IPv4 address bindings.丟棄具有無效 MAC 對 IPv4 位址綁定的 ARP 封包。
In a typical network DAI configuration, configure all access switch ports that are connected to host ports as untrusted and all switch ports that are connected to other switches as trusted. With this configuration, all ARP packets entering a switch from another switch bypass the security check, which is safe because all switches validate the ARP packets as they are sent by hosts that are connected to untrusted access ports.
在典型的網路 DAI 設定中，將所有連接到主機連接埠的存取交換器連接埠設為不信任，並將所有連接到其他交換器的交換器連接埠設為信任。在此設定下，所有從另一台交換器進入本交換器的 ARP 封包都會跳過安全檢查，這是安全的，因為所有交換器都會驗證從連接到不信任存取連接埠之主機所發送的 ARP 封包。
To mitigate the chances of ARP spoofing, these procedures are recommended:
為降低 ARP 偽造發生的機率，建議採取以下程序：
- Enable DHCP snooping globally.全域啟用 DHCP 窺探。
- Enable DHCP snooping on selected VLANs.在選定的 VLAN 上啟用 DHCP 窺探。
- Enable DAI:啟用 DAI：
- Use the
ip arp inspectionvlan-id command to enable ARP inspection on selected VLANs.使用ip arp inspectionvlan-id 命令在選定的 VLAN 上啟用 ARP 檢查。
- Configure trusted interfaces for DHCP snooping and ARP inspection (untrusted is the default configuration).為 DHCP 窺探與 ARP 檢查設定信任介面（預設設定為不信任）。
- Use the
ip arp inspection trustcommand, to enable DAI on an interface and set the interface as a trusted interface使用ip arp inspection trust命令，在介面上啟用 DAI 並將該介面設為信任介面
In the example configuration, switch SW has globally enabled DHCP snooping. DHCP snooping and ARP inspection are enabled for the PC VLAN, VLAN 10. The uplink, the Ethernet 0/0 interface, is configured as trusted for DHCP snooping and ARP inspection.
在此範例設定中，交換器 SW 已全域啟用 DHCP 窺探。DHCP 窺探與 ARP 檢查已針對 PC 所在的 VLAN 10 啟用。上行連結 Ethernet 0/0 介面則被設定為 DHCP 窺探與 ARP 檢查的信任介面。
SW(config)# ip dhcp snoopingSW(config)# ip dhcp snooping vlan 10SW(config)# ip arp inspection vlan 10SW(config)# interface ethernet 0/0SW(config-if)# ip dhcp snooping trustSW(config-if)# ip arp inspection trustTo view the status of the DAI configuration, the show ip arp inspection and show ip arp inspection interfaces commands can be used. To review DAI activity, the show ip arp inspection log and the show ip arp inspection statistics commands can be used.
若要檢視 DAI 設定的狀態，可以使用 show ip arp inspection 及 show ip arp inspection interfaces 命令。若要檢閱 DAI 活動，可以使用 show ip arp inspection log 及 show ip arp inspection statistics 命令。
Dynamic ARP Inspection in Action
動態 ARP 檢查實際運作
The figure below shows a user with an IPv4 address of 10.0.1.2 connected through a switch to a default gateway with an IPv4 address of 10.0.1.1. An intruder residing on an untrusted port sends an unsolicited ARP message in an attempt to poison the MAC-to-IPv4 bindings so that all traffic from 10.0.1.2 to the 10.0.1.1 default gateway goes to the attacker. The attacker attempts to poison the ARP cache of 10.0.1.2, so 10.0.1.2 thinks the attacker MAC address is the MAC address of the 10.0.1.1 default gateway.
下圖顯示一位使用者的 IPv4 位址為 10.0.1.2，透過交換器連接到 IPv4 位址為 10.0.1.1 的預設閘道。位於不信任連接埠上的入侵者發送未經請求的 ARP 訊息，試圖污染 MAC 對 IPv4 綁定，讓所有從 10.0.1.2 送往 10.0.1.1 預設閘道的流量都改送給攻擊者。攻擊者試圖污染 10.0.1.2 的 ARP 快取，使 10.0.1.2 誤以為攻擊者的 MAC 位址就是 10.0.1.1 預設閘道的 MAC 位址。
DAI examines the ARP packet and compares its information with the information in the switch DHCP binding table. Because there is no match for the 10.0.1.1 IPv4 address to the attacker MAC address of aaaa.1111.2345 in the DHCP binding table, the ARP packet is dropped.
DAI 會檢查 ARP 封包，並將其資訊與交換器 DHCP 綁定表中的資訊比對。由於 DHCP 綁定表中沒有將 10.0.1.1 這個 IPv4 位址對應到攻擊者 MAC 位址 aaaa.1111.2345 的紀錄，因此該 ARP 封包會被丟棄。