Similar to the way ARP resolves IP addresses to MAC addresses on a LAN, DNS resolves domain names to IP addresses. Since devices keep a local cache of addresses, the victim will now see the attacker’s device as trusted for a duration of time. When an app needs to know the address of a certain device, such as tv.local, an attacker can easily respond to that request with fake data, instructing it to resolve to an address it has control over. Devices such as TVs, printers, and entertainment systems make use of this protocol since they are typically on trusted networks.

Users don’t have to know exactly which addresses their devices should be communicating with they let the system resolve it for them. The local name resolution system is supposed to make the configuration of network devices extremely simple. This makes it a perfect target for spoofing attacks. Multicast DNS is similar to DNS, but it’s done on a local area network (LAN) using broadcast like ARP. Valuable information can be extracted from the traffic, such as the exchange of session tokens, yielding full access to application accounts that the attacker should not be able to access. With some precisely placed packets, an attacker can sniff the private traffic between two hosts. If the address is not known, a request is made asking for the MAC address of the device with the IP address.Īn attacker wishing to pose as another host could respond to requests it should not be responding to with its own MAC address. When a host needs to talk to a host with a given IP address, it references the ARP cache to resolve the IP address to a MAC address. It is used to resolve IP addresses to physical MAC (media access control) addresses in a local area network. This is dangerous because the attacker does not even have to be on a trusted network to do this-the attacker simply needs a close enough physical proximity.ĪRP is the Address Resolution Protocol. All of the victim’s network traffic can now be manipulated by the attacker. Attackers can set up their own wireless access point and trick nearby devices to join its domain. Devices equipped with wireless cards will often try to auto-connect to the access point that is emitting the strongest signal.

Mac address flooding man in the middle