Tag: arp

WoL – Wake On LAN

If a computer on local LAN network is turned off and administrator needs to do some regular maintenance on it, he will need to use Wake-On-LAN (WoL) to power the system up remotely.

Of course, network devices need to be configured to enable that kind of “magic” packet forwarding.

NIC cards on machines need to support WoL for this to work, but we don’t bother with this here..

WoL is sending “magic packets” to computer NIC card in order to start the system up. NIC which supports WoL is still receiving power when PC is turned off. NIC then keeps listening on the network for the magic packet and if received it will initialise the system boot process and power up the PC.

Magic packet is specially crafted network directed broadcast packet typically sent with connectionless UDP, port 7.

You would usually have a WoL server somewhere on you network which will be used to source magic packets. If you send magic packets across network segments (between VLANs or from some remote subnet), last router in the path, one having client subnet locally connected, needs to be configured with directed broadcast. The first router on the path, router with server subnet locally connected, should have ip helper configured pointing to directed broadcast IP address (in our case 172.19.1.255).

In our example below, both ip helper and directed broadcast are configured on the same L3 device since this is the only router connecting two subnets.

Directed broadcast on Cisco devices is off by default since IOS 12.0 and needs to be configured on specific subnets where WoL will be needed.

You need directed broadcast because PC which needs to be woken up is asleep and while asleep it will not have an IP nor it will respond to ARP. Only way to get some packets to that PC without an ARP resolution is by using local subnet L2 broadcast.

Furthermore, we can surely assume that your PCs are connected to L2 Access Switch. That switch will not know to which port is the PC connected while that PC is asleep. Only a Layer 2 broadcast (and unknown unicast) will be sent out all ports on a switch.

What is route recursion

We are going back to networking basics with this post. In few lines below you will find most important theory that makes network gear do its job.

The main router job is to making routing decisions to be able to route packets toward their destination. Sometimes that includes recursive lookup of routing table if the next-hop value is not available via connected interface.

Routing decision on end devices

Lets have a look at routing decision that happens if we presume that we have a PC connected on our Ethernet network.

If one device wants to send a packet to another device, it first needs to find an answer to these questions:

  • Is maybe the destination IP address chunk of local subnet IP range?
    • If that is true, packet will be forwarded to the neighbour device using Layer 2 in the ARP example below.
    • If that is not the case, does the device network card configuration include a router address through which that destination can be reached? (default gateway)
  • Device then looks at his local ARP table. Does it include a MAC address associated with the destination IP address?
    • If the destination is not part of the local subnet, does the local ARP table contain the MAC address of the nearest router? (MAC address to IP address mapping of default gateway router)

Proxy ARP

I found different kinds of explanations about what Proxy ARP is, just few of them were understandable at first. After merging all of them this explanation came out of my networking workshop:

  • Assuming that a router has an ARP entry of some IP address, if he receives an ARP request from somebody for that IP, the router will respond with its own MAC address.
  • Proxy ARP is fairly simple technique for nodes to get MAC address of a destination host that is on a different subnet but on the same router. Same router different interface.

And this one to:

  • If we have in the network one edge router that is our way out from the local LAN network. That router has Proxy ARP enabled by default. When it receives an ARP request on his interface for a client that is not actually from that local network it will try to be helpful and it will search his routing table if that network is locally connected on some other local interface. If he finds it, it will respond with his own MAC address to tell the source that he is the way to go towards that host.

If we look at the image below, I prepared a more detailed example for those who are still a bit confused about it.

It’s a technique that enables our R7 router on the image below to proxy ARP request from C1 computer which tries to find MAC address of computer C3.

You need to note that C1 has address from /16 range and that is why it thinks that 192.168.50.50 is on the same subnet as 192.168.1.11 . If that was not the case and C1 had the address 192.168.1.11/24, it would send the ARP asking what is MAC address of default gateway. It will go to default gateway because he will know that he is not directly connected to all of network 192.168.0.0/16. We are then talking about standard routing by getting the packets from one subnet to another using routing table examination.

Spoofing Attacks – ARP Spoofing

How attacker can launch man in the middle attack using ARP spoofing and what is ARP spoofing?
Attackers can attempt to launch an attack by sending gratuitous ARP – GARP replies. GARP reply messages are sent from some device in the network to other without the prior receiving of a request for sending a ARP reply. Is an ARP reply without cause. This reply without cause can tell network devices that the attacker’s MAC address corresponds to specific IP addresses that is actually IP address of some other device in the LAN.

Manage Router’s ARP Cache

Address Resolution Protocol (ARP) cache is a table where router or computer is keeping Layer 2 MAC addresses to Layer 3 IP addresses mappings which hw resolved lately. Without MAC to IP mapping the device would not be able to build and send IP packets.

Device discovers the MAC to IP mapping using ARP protocol Broadcast requests on the local subnet and saves the mapping in the ARP cache. If a device wants to send a packet to a neighbour, and it doesn’t have a corresponding MAC address, it sends out a broadcast ARP request packet. This broadcast packet reaches every device on the local subnet. Everybody will receive that ARP request packet but only the one device with the IP address mentioned in  ARP broadcast request packet responds back with an ARP response packet to complete the process.