-: In the last lesson, we talked about
the concept of DNS poisoning.
In this lesson, I want to cover the concept
of ARP poisoning with you fairly quickly.
Now, ARP stands for the address resolution protocol,
like you learned back in Network+,
and it's used to convert an IP address into a MAC address.
If you remember back from Network+
and our OSI model lesson, as data moves down
the OSI stack, it uses IP addresses to transmit packets
all over the world from router to router.
But once it finds the right router,
that router converts that IP address
into a MAC address and passes it on to the switches
inside of its own network, and that is going to help it
to deliver the information using frames
inside the data link layer.
Now, ARP poisoning is going to exploit the way
that an ethernet network works.
It's going to enable an attacker to steal,
modify, or redirect frames of information on the network.
The concept here is that the attacker is going to associate
their MAC address with the IP address
of another device within the network.
This way, whenever the router asks for the MAC address
that's associated with that IP,
they get the attacker's MAC address
instead of the legitimate user's.
This allows the attacker to essentially take over
any session that would involve MAC addresses
at the layer two of the OSI model.
Also, if the attacker wanted to get really creative here,
they could set up a man in the middle
using this technique by taking over the MAC address first,
then passing the data back and forth
between the victim and the rest of the network.
To prevent ARP poisoning, you should set up
good VLAN segmentation within your network,
and also set up DHCP snooping to ensure
that IP addresses aren't being stolen
and taken over by an attacker.