Re: Using ARP to map a network

From: Jason Lewis (jlewis@packetnexus.com)
Date: 02/05/03

  • Next message: Rob Shein: "RE: Routes that are susceptible to SNMP" 
    Date: Tue, 4 Feb 2003 19:32:53 -0500 (EST)
From: "Jason Lewis" <jlewis@packetnexus.com>
To: <pen-test@securityfocus.com>

    This may be part of my problem. I have a list of IPs and MACs. There are
    multiple MACs tied to a single IP. I was under the impression this data
    was gathered from ARP tables from several machines across the network.

    I figured the reason I was seeing multiple MACs for a single IP was
    because the router responded for the IP behind it. Any other explanation
    for what I am seeing?

    jas

    > Jason,
    >
    > If the machines were behind a router you would not see anything for ARP.
    > At that point you are routing and not switching. True, you would see
    > an MAC address for the router but remember, the MAC address is part of
    > the frame and the IP address is part of the packet. Therefore the only
    > time that the two are tied together is on the local subnet.
    >
    > Any tool to map networks based on arp tables would have to have access
    > to the arp tables for each individual subnet.
    >
    > "If machines were behind a router the ARP tables would show multiple
    > IP's with the same MAC." No, the arp tables would only show the routers
    > IP address and the mac address of the router. A routing table would
    > show IP addresses "behind" the routers IP address (maybe, default routes
    > would throw this off). Routing tables are global while arp tables are
    > local to the subnet.
    >
    > Hope this helps.
    >
    > Kevin
    > ----- Original Message -----
    > From: "Jason Lewis" <jlewis@packetnexus.com>
    > To: <pen-test@securityfocus.com>
    > Sent: Tuesday, February 04, 2003 6:36 PM
    > Subject: Using ARP to map a network
    >
    >
    >> I have searched and can't seem to find any tools to help map a network
    >> based on ARP tables.
    >>
    >> It seems to me, I could take ARP tables from several machines and
    >> build a network map. If machines were behind a router the ARP tables
    >> would show multiple IP's with the same MAC. With enough ARP tables,
    >> wouldn't I be able to build a map?
    >>
    >> Is my theory flawed?
    >>
    >> My goal is to do passive network mapping based on any local
    >> information I can obtain from computers or network devices. Anyone
    >> have any ideas?
    >>
    >> jas
    >>
    >>
    >>
    >> --------------------------------------------------------------------------
    > --
    >> This list is provided by the SecurityFocus Security Intelligence Alert
    > (SIA)
    >> Service. For more information on SecurityFocus' SIA service which
    >> automatically alerts you to the latest security vulnerabilities please
    > see:
    >> https://alerts.securityfocus.com/

    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
    Service. For more information on SecurityFocus' SIA service which
    automatically alerts you to the latest security vulnerabilities please see:
    https://alerts.securityfocus.com/

    Relevant Pages

    • Re: Pure IP & ARP broadcasts
      ... It actually communicates via the MAC address of the Nics (aka Layer2 ... what the ARP request does. ... A host has a packet to send, it has the IP# and nothing else. ... But if the owner of the IP# is not on that segment then the Router replies ...
      (microsoft.public.windows.server.networking)
    • Re: Router problems
      ... >> AFAICT my router only shows computers attached that were allocated IP ... The router status gives the MAC addresses of the ADSL port, ... ARP is used by every device running TCP/IP ...
      (comp.sys.acorn.networking)
    • Re: Connecting a user to AOL (anything I should know?!)
      ... it's used for routing ... ... I am saying that what is done with an ARP table is not called Routing. ... Quite different to hard wired / the concept of MAC being hard wired. ... Wouldn`t "Cable modemA" change the MAC to that of the ISP`s Router? ...
      (uk.comp.homebuilt)
    • Re: cannot ping anything
      ... That is fine I understand that the box is communicating with the router and negotiating leases when they expire. ... why has the gateway to 192.168.1.1 changed from link#1 to the MAC address of my router. ... You'll see the MAC address after the box has tried and succeeded with an arp ... Greg Barniskis, Computer Systems Integrator ...
      (freebsd-questions)
    • Re: Using ARP to map a network
      ... If the machines were behind a router you would not see anything for ARP. ... "If machines were behind a router the ARP tables would show multiple IP's ... > This list is provided by the SecurityFocus Security Intelligence Alert ...
      (Pen-Test)