108
edits
ARP module: Difference between revisions
Jump to navigation
Jump to search
no edit summary
(Created page with "The Address Resolution Protocol (ARP) is used on layer 2 to track which hardware (MAC address) uses which IP address. The ARP module monitors requests and replies and builds...") |
No edit summary |
||
| Line 2: | Line 2: | ||
The ARP module monitors requests and replies and builds a database of all known MAC and IP addresses and their correlation. | The ARP module monitors requests and replies and builds a database of all known MAC and IP addresses and their correlation. | ||
It also accounts possible spoofing alerts, when some computer send or reply with wrong MAC addresses, or multiple computers answer with the same IP. | It also accounts possible spoofing alerts, when some computer send or reply with wrong MAC addresses, or multiple computers answer with the same IP. | ||
Those events may indicate some problem within the network, due to misconfiguration or an attack. | Those events may indicate some problem within the network, due to misconfiguration or an attack. | ||
'''Overview''' | |||
''' | |||
{| class="wikitable sortable" | {| class="wikitable sortable" | ||
|- | |- | ||
| Line 11: | Line 10: | ||
|} | |} | ||
The overview tab shows the number of all ARP requests seen, and the number of replies. The history graph shows the number over time. As usual, zooming can be applied to view a larger time window. | |||
'''MAC addresses''' | '''MAC addresses''' | ||
{| class="wikitable sortable" | |||
|- | |||
|[[File:ARP_MAC.png|800px|none|right]] | |||
|} | |||
The MAC address tables shows for each MAC address the last assigned IP address, that is the IP address that have announced by the corresponding MAC address. | The MAC address tables shows for each MAC address the last assigned IP address, that is the IP address that have announced by the corresponding MAC address. | ||
| Line 27: | Line 29: | ||
Otherwise it indicates that a devices sends ARP request with a forged sender address. | Otherwise it indicates that a devices sends ARP request with a forged sender address. | ||
'''IP addresses''' | '''IP addresses''' | ||
{| class="wikitable sortable" | |||
|- | |||
|[[File:ARP_IP.png|800px|none|right]] | |||
|} | |||
The IP addresses tab views the reverse direction, showing the MAC addresses used for each IP address. | The IP addresses tab views the reverse direction, showing the MAC addresses used for each IP address. | ||