Wireshark 101: Address Resolution Protocol, HakTip 124

Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:
____________________________________________
Today on HakTip, Shannon Morse breaks down ARP packets - how to distinguish an ARP packet in Wireshark and what each part of the packet means.
Today we're checking out Wireshark and Address Resolution Protocol.
Today we're going to delve into understanding normal traffic patterns with TCP/IP and ARP packets, and being able to find abnormal happenings on your network. First, your computer will send out a thing called an ARP request whenever your first computer (A) is trying to talk to another computer (B). This basically means "your computer has XXX IP address and XXX MAC address, and it's trying to send something to XXX IP address, but it doesn't know the MAC address. The Address Resolution Protocol (ARP) will respond with "that's me! Here's my MAC address" and then everything is shiny and happy because both parties can see each other and send packets to each other. Now let's look at an example of what an ARP packet header looks like on Wikipedia! An ARP header will have a Hardware type (like type 1 for Ethernet), Protocol Type (IPV4 would be listed as 0x0800). And a step down will be the Hardware address length (such as 6 for Ethernet), and a Protocol Address length (IPV4 is 4). Below this will be the Operation that the sender is doing - 1 for request, or 2 for reply. Then you'll have the Sender's Hardware Address and Protocol Address. And lastly is the Target's Hardware and Protocol Address. These last few would be ex. the MAC address for hardware, and the IP address for protocol.
If I run a packet capture in Wireshark and look for ARP, I can find one that has an Address Resolution Protocol packet header for a request and reply. You'll notice the MAC address is listed under Wireshark as 00:00:00:00:00 because it's currently not known. But if we find the reply packet, you'll notice that the MAC is now filled in.
If devices on your network tend to change IP addresses, which is common, then Wireshark will send out something called a Gratuitous ARP, which basically means it'll keep the destination open so when it receives replies, it'll collect all the new IP addresses of the other machines on the network. The Destination will be set to something like ff:ff:ff:ff:ff:ff:ff and the target and sender IP addresses are the same.
Let me know what you think. Send me a comment below or email us at [e-mail]. And be sure to check out our sister show, Hak5 for more great stuff just like this. I'll be there, reminding you to trust your technolust.
~-~~-~~~-~~-~
Please watch: "Bash Bunny Primer - Hak5 2225"
• Bash Bunny Primer - Ha...
~-~~-~~~-~~-~
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community - where all hackers belong.

[@daviangel]

Thumbs up just for the way she says ARP ARP ARP!
Man my networking classes would've have been so much more fun with Shannon in them and I would've actually went to class LOL.

[@DS-ce4um]

Great video! But I just wanted to add some supplemental information regarding ARP requests:
ARP is used to match IP addresses to MAC addresses. MAC addresses are needed for a computer to know where to send information to on the data-link layer (OSI model). Because of this, your computer can't talk to other computers with just an IP address, it needs the MAC address.
Your computer keeps MAC Addresses stored in the ARP table. If it doesn't have an entry for an IP address, it sends out a broadcast to all devices on the network asking 'Who has this IP?'. All devices on the network will hear this message, but only the one with the correct IP will respond and say "I do! Here is my MAC address!".
Once it does that, your computer will add an entry for that IP address into its MAC table and the devices can now communicate.
Why this is important to Wireshark:
If you are seeing ARP requests for IPs that don't exist on your network, it's possible that someone is doing a ping scan (potentially malicious) or a service is misconfigured. You can use bad ARP requests to track down the PC that is sending them out and investigate why it is happening.

[@hak5]

David Sullivan Great info! Thanks for sharing.

[@Daniel_CLopes]

Awesome!

[@Ferocious_Imbecile]

It doesn't answer all my questions but it goes a long way to helping me learn all this stuff. Thanks for the video.

[@germansanchez4391]

Love the way you teach this stuff you make it understandable

[@kreep182]

thats exactly what i needed. thanks alot.

[@robinsmidsrod]

Would've liked to see a reply packet analyzed too. Just seeing one part of the conversation is a bit unfortunate. An arp poisioning attack would also be interesting.

[@FunIsGoingOn]

Request and reply packets have the same format, so they could be analysed accordingly. There are sample captures on wireshark.org. Arp Posioning was coveres in hak5's very first season like 5 years ago, just search for hak5 arp poisoning like watch?v=EF3kZF6MLUo and watch?v=7YAhi0aikT8 and watch?v=7FQO5jisQoI ...

[@rob-karenkennedy-parker3166]

Great video. Ty.

[@jamesrodriguez8494]

What does the protocol say(or Shannon) , ARP ARP, ARP

[@Rockyx01]

Awesome!

[@deadccie7011]

which type of broadcast ARP do. How ARP packet look like.

[@KowboyUSA]

Another one for the Favs folder.

[@jackofallthings1764]

What would you consider too many ARP requests? Where does normal traffic end and where does a broadcast begin?

[@SP-rj1xc]

How do I find the Source and Destination though?

[@joeli0820]

Arp arp arp arp arp arp I would say that for a while when I learn about arp in my class that used the Cisco networking academy aka netacad

[@omgwtfbbqalekx]

cool story bro. tell us more.