Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FAQ
It is currently Wed Aug 23, 2017 8:56 am


Internet Protocol, Transport Control Protocol, Network protocols, Routing, Routers, IP aliases, Routes, Ethernet

Author Message
admin
  Post  Post subject: How to generate GRATUITOUS ARP REQUEST on FreeBSD using nemesis packet crafting tool  |  Posted: Thu Feb 23, 2012 4:49 am
Site Admin

Joined: Mon Aug 03, 2009 8:43 am
Posts: 95

Offline
 

How to generate GRATUITOUS ARP REQUEST on FreeBSD using nemesis packet crafting tool

Before going deeper into gratuitous arp, I will introduce "nemesis".

NEMESIS is a command line packet crafting tool able to generate l2 frames / ip packets giving one the possibility to manipulate the arp/ip/tcp/icmp headers.

One and the only disadvantage I see is that it cannot close tcp handshakes (as far as I can see), but it is not the purpose of this article.

Gratuitous arp is a simple mechanism used for different reasons, but the most important one is High Availability Active-Passive(backup) clusters (firewalls or Unix) when failover needs to be performed.

Both cluster nodes share a virtual IP (VIP). When one node goes down for whatever reason, the backup node needs to become active and take assignment of the VIP. But the peering devices still have in their arp table an entry for the VIP and the mac address of the failed node.

Enter gratuitous arp request: It is sent by the failover node and it notifies peered (l3) devices that the VIP sits on the mac address of the node in question.

Besides nemesis, there is another utility, "arping" that allows gratuitous arp (requests and replies), but beware: There is arping from "iputils" package available only for Linux (wasn't able to compile it on FreeBSD) that allows you to use the mac of the interface where you are sending the gratuitous arp. It does not allow you to specify the mac address.

Arping from FreeBSD ports does not know gratuitous arp (when I last played with it).

Before I begin the test, here is the entry in the target host's arp table:
Code:
# arp -an | grep 192.168.0.1
? (192.168.0.1) at 00:11:2f:8d:05:fa on em0 [ethernet]


Now, I will use nemesis to change the target host's arp entry to '00:11:2f:8d:05:fb' instead of '00:11:2f:8d:05:fa':
Code:
nemesis arp -S 192.168.0.1 -D 192.168.0.1 -s -H 00:11:2f:8d:05:fb


Checking if the arp table was updated:
Code:
# arp -an | grep 192.168.0.1
? (192.168.0.1) at 00:11:2f:8d:05:fb on em0 [ethernet]


And the tcpdump of the gratuitous arp request:
Code:
# tcpdump -nteli em0 arp
00:11:2f:8d:05:fb > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: arp who-has 192.168.0.1 (ff:ff:ff:ff:ff:ff) tell 192.168.0.1


The source mac address of the gratuitous arp request is '00:11:2f:8d:05:fb' and the destination is the broadcast. It is generaly only one packet necessary to update a host's arp table.

If this doesn't work, check for l2 filters on your switch or static arp entries.





Top
Display posts from previous:  Sort by  
E-mail friendPrint view

Topics related to - "How to generate GRATUITOUS ARP REQUEST on FreeBSD using nemesis packet crafting tool"
 Topics   Author   Replies   Views   Last post 
There are no new unread posts for this topic. Sendip packet crafting tool: How to send bad checksum TCP packets

mandrei99

2

1560

Wed Apr 15, 2015 2:02 am

lizamare View the latest post

There are no new unread posts for this topic. TCP first packet loss

satk

1

418

Tue Jan 22, 2013 9:20 am

admin View the latest post

There are no new unread posts for this topic. TCP first packet loss

satk

0

357

Wed Dec 12, 2012 4:44 am

satk View the latest post

There are no new unread posts for this topic. FreeBSD PF supported icmp types

admin

0

1136

Fri Jan 28, 2011 9:15 am

admin View the latest post

There are no new unread posts for this topic. FreeBSD - multiple routing tables

mandrei99

0

4820

Wed Aug 28, 2013 8:40 am

mandrei99 View the latest post

There are no new unread posts for this topic. FreeBSD: How to list IPv6 neighbors

mandrei99

0

1941

Mon Oct 06, 2014 10:00 am

mandrei99 View the latest post

There are no new unread posts for this topic. FreeBSD show network interface statistics

mandrei99

0

2161

Wed Sep 25, 2013 9:30 am

mandrei99 View the latest post

There are no new unread posts for this topic. Set up FTP PROXY via command line in Linux/FreeBSD

mandrei99

0

15229

Tue Jan 20, 2015 5:01 pm

mandrei99 View the latest post

There are no new unread posts for this topic. FreeBSD tcpdump on enc0 doesn't show any traffic

mandrei99

0

1432

Fri Jun 21, 2013 8:54 am

mandrei99 View the latest post

There are no new unread posts for this topic. FreeBSD - Adding VLAN Tagged subinterface using ifconfig

admin

0

7258

Mon Aug 19, 2013 10:44 am

admin View the latest post

 

Who is online
Users browsing this forum: No registered users and 0 guests
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
Jump to:  
News News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list


Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]



phpBB SEO