What Is the Aim of An Arp Spoofing Attack?

• With the help of ARP reply broadcast flood, the network
• To fill the MAC address tables with bogus addresses
• To flood network host with ARP request
• To link the internet protocol address to the wrong MAC address

Answer:

In the ARP spoofing attack, a malicious host interrupts the ARP request and depends on them so that the host of the network will map the address to the MAC addresses of the malicious host.

What is the address resolution protocol?

ARP is a protocol that allows network communications to reach particular devices on the network. Address resolution protocol (ARP) translates the internet protocol address to the media access control (MAC) and vice versa. Most commonly, the connection of ARP to the gateway or router is the devices that allow them to link to the internet.

The responsibilities of the host are to maintain a mapping table between the internet protocol addresses and the media access addresses, maintain an ARP cache, and use the addresses to connect to their destinations on the network. If the host does not know the media access address for a particular IP address, it sends out the address resolution protocol request packet. It asks the other machines on the network to match the MAC address.

ARP protocol is not responsible for security, so it does not a concern to verify whether the response of the request comes from the authorized party or not. Even if the request is not sent it allows the host to accept the ARP response. This is the weakest point of the ARP protocol that allows the ARP spoofing attackers.

In the IPv4 protocol, ARP works on the 32-bit IP addresses.  The new versions of protocol IPv6 use a different protocol. NDP (neighbor discovery protocol) is safe, and secure and uses the coded keys to verify the host identity. However, still, most of the older IPv4 protocols are used by the internet. Address resolution protocols are still widely in use.

Spoofing:

It is an attack that a third party into the internet protocol network trying to falsify the original data. It means that the original data is swept with the falsified data by doing some modification. The IP protocol does not use any authentic mechanism to verify the person. If one application does not verify the authorized user, many spoofing attacks may occur. There are two different types of spoofing attacks. Which are,

• IP spoofing
• Address resolution protocol (ARP)

Address resolution protocol (ARP) spoofing or ARP poisoning:

An ARP poisoning or also called ARP spoofing allows the attackers to interrupt the communication between two network devices. The attack work in the following way,

• Network access:

Malicious attackers have access to the network. They scan the network to know the internet protocol address of at least two devices. Consider the two devices are a router and a workstation.

• Spoofing tool:

Spoofing tools are also used by the attackers such as Driftnet, and Arps proof, to send out the build ARP response.

• Forged response:

The forged response displays that the MAC address is correct for both IP addresses that relate to both the router and the workstation. It is the attacker’s MAC address. This fools both devices and connects to the attackers’ MAC addresses instead of connecting.

• ARP cache:

ARP cache entries are updated in two devices and from onward, they communicate with the attackers instead of with each other.

• Man in the middle:

Attackers are now a man in the middle of all conversations. It pretends to be both sides of a communication channel.

What attackers can do?

After the attackers are successful in the ARP spoofing attack. They can do all sorts of things like,

• Alteration in communication:

For example, it pushes a malicious file to the workstation.

• Hijacking:

if the attackers were able to access the session ID. In this way, they have access to the hosting account that is currently logged into.

• Routing the communication:

The attackers steal the data and packets. But there is an exception if the file is transferred over the encoded channel like HTTPS.

• DDoS (distributed denial of service):

The attackers provide the media access protocol to the server with the DDoS they wish to attack. Instead of their machines being affected. The target server will be hit with traffic if they attack with a large number of internet protocol addresses.

Detection:

Here is the important question of how to detect the attacks. Here is a very simple detail to detect the ARP cache poisoning attack by using the command line. Given below the commands are given to follow on both windows and Linux.

If the table display two different IP address have the same media access address it indicates that an ARP attack has occurred. Because the 192. 168.5.1 can be recognized as a router and the IP address for the attackers is probably 192.168.5.202.

You can use the open-source Wireshark protocol to identify ARP poisoning in a large network. Also, use to obtain more information about the communications the attackers are taking place.

Prevention:

A few important practices that can help to prevent attacks on the network are given below.

• Use stable ARP:

You need to define a stable ARP entry for an IP address. And prevent all the ARP responses for that particular address. For example, if your workstation always links to the same router then define a stable ARP entry for that router. In this way, attacks can be prevented.

• VPN:

A virtual private network enables the devices to connect to the router through a coded tunnel. This makes all the communication encoded and worthless for attackers.

• Packet filtering:

With the use of packet filtering, it can identify poisoned attacks by pointing out that they contain contradictory information. It stops this information before they reach your system.

• Mount a spoofing attack:

Make sure the existing defenses are working or not against attacks.  Always coordinate with the security and IT teams. If the attack takes place, then identify the weakest point in your system and remediate them.

Aims of ARP poisoning attack:

Some attackers have intentions to create a foundation for harmful effects in the future. The attack defines the intention of attackers, like

• To associate a valid IP with a bogus MAC address.
• To pack the original MAC address with the fake MAC address
• To flood the targeted host with enormous reply messages of ARP
• To flood ARP requests so that the host network becomes packed.

Final words:

The cyber-world is full of risks. There are no lame excuses that are acceptable or show a lenient attitude towards cyber security. ARP attack is a very serious cyber rime that can harm many people beyond imagination. Adopting a good prevention method and a proactive approach solves this issue in the initial stage.

What Are Two Reasons for Physical Layer Protocols to Use Frame Encoding Techniques? (Choose two.)?

Answer:

• To provide better correction of an error in media
• To indicate where the frame starts and end
• Decrease the number of collisions in the media
• Differentiate between the control bits and the data bits.
• Enhance the media throughput

The main two reasons for the physical layer to use the frame encoding technique are to provide better error correction in media and to differentiate between the control bits and the data bits. An encoding is responsible for the conversion of streams of bits into defined code that is recognizable to the receiver and the transmitter.

Physical layer protocol:

In the OSI model (open system interconnection) physical layer is the first and lowest layer in this model. It is also known as layer 1 responsible for bit-level transmission between different devices and also provides support to the mechanical and electrical interfaces connected to the physical medium for accompanied communication. For most of the network physical connections this layer is used, for example, cabling, connectors and types, wireless transmission, network interface cards, and cabling standards with types. This layer has nothing to do with a physical medium such as fiber and copper.

Role of physical layer:

Over the physical data link connected nodes of the network, this layer provides a way to transmit the streams of data bits. The bitstreams are gathered into symbols and converted to a physical signal that is transmitted over the medium. Electronic circuit transmission networks are present in the physical layer. It is a fundamental layer due to the high level of function in a network.  In the open system interconnection model from the data link layer physical layer translate the logical communications into hardware operations to cause the reception of electronic signals. Higher layers are supported by the physical layer that is responsible for the generation of logical data packets.

Functions:

• USB (universal serial bus):

In the USB controller in the host physical chips are integrated to provide a bridge between the digital and the regulated parts of the interface.

• Serial ATA:

The physical layer is used by Serial ATA controllers.

• Infrared data association:

IrDA specification uses the IrPHY specification for the data transport.

What Devices Are Used in Networking?

Answer:

Different type of electronic devices is used in networking these devices are known as networking devices or networking equipment. In between the computers, printers, and fax machines for the transmission and the receiving data these networking devices are used. There are two types of devices either internetwork or another intra-network. some networking devices are installed on the device like RJ45 connectors and some devices are part of the network such as switches, hubs, and routers. To perform their roles efficiently these devices are specific devices to handle the electrical and digital connections.

Network devices:

Between the different hardware, the devices used for communication in the computer network are called network devices. These are also called computer networking devices, physical devices, network equipment, and networking hardware. Each device performs its functions and works for different purposes.

Types:

There are different types of networking equipment to perform their function efficiently in the computer which include,

• Modem
• Bridge
• Network Hub
• Network switch
• Repeater
• router

Bridge:

this network device is used to connect two or more network segments. The main function of this device is the storage and transmission of the frame in various segments. Media Access Control is used in this device for transferring frames.

Network router:

It is used to route the traffic from one network to another network. These two networks must be private to the company network.

Modem:

It is the most important device and is used in daily life. For example, in our homes net is provided with the help of wires, these wires carry data from one place to another place. But every computer gives digital data in the form of zeros and ones.

Network switch:

Switch also worked on LAN just like the hub but it is more active than the hub. The switch is used to transfer and filter data while the hub is used for data transfer.

Network hub:

The Network Hub is used to communicate with a different host of networks and is also used for data transfer. Data is transferred in the form of packets.

What Is the Session Layer in OSI Model?

The session layer in the OSI model (open system interconnection) is the fifth layer which is responsible for the connection between the various computers. Between the computers session layer tracks the dialogs these are also called sessions. Between the local and remote applications session layer controls, establish, and ends the sessions.

The session layer manages the sessions by stimulating the opening and closing of the sessions between the users’ applications. This layer also controls the single or multiple connections and directly communicates with the transport layers and presentations. This service is only offered by the session layer and implemented in the applications environments using RPCs (remote procedure calls).

Mostly on web browsers sessions are implemented by using protocols such as the session control protocol, the AppleTalk protocol, and the zone information protocol.  These protocols are responsible for the management of the session restoration via recovery and checkpointing Both full-duplex and half-duplex are supported by session layers that create restart, termination, and checkpoint procedures. It also synchronizes information from different sources. For example, the session layer is implemented in TV shows when the audio and the video from the different sources are merged together. This helps in preventing overlapping and the silent broadcast site.

Functions:

• The session layer offers token management it prevents the two users try to access or attempting the same operation simultaneously.
• It controls the dialog through which it communicates with the full-duplex and the half-duplex modes of communication.
• Synchronization is achieved by adding checkpoints which are considered synchronization points to the streams of data.
• The session layer also offers recovery and checkpoints.
• Between the end-user application process, this layer provides the mechanism of the closing, opening, and management of the sessions.
• It synchronizes the information from different sources just like in TV shows.
• At the point from which the communication failure occurred session layer uses the checkpoints to enable communication and resumes from those points.
• From the transport layer, the session layer receives and catches data and sends it to the presentation layer after it.

What Does Rdp Stand for In Computers?

RDP stands for Remote Desktop Protocol in a computer. It is the Microsoft protocol designed to ease the application such as data transfer and encryption between the clients, network servers, and the devices. It allows distant users to add a graphical interface to the desktop of another computer. With the multiple types of the Local area network, RDP is compatible with these types according to the ITU-T.120 protocol. 64,000 different data channels are supported by Remote Desktop Protocol for multipoint transmission. The functions of the remote desktop protocol are to provide initialization of connections, data transfer between server and client, and negotiation capabilities. The support provided by the Rdp to the following services are,

• User keyboards data cipher and the mouse.
• Sharing of clipboards between the local clients and the remote servers.
• Audio, file redirection, and the printer, port.
• RDS provides the RDP functionality through windows 2008 R2 with service pack 1.
• Using Remote Desktop Connection, RDP applications run on client computers.

In 2011 version 6 are releasing the multiple features are added to this version. These features include WMP (windows media player), WPF (windows presentation foundation) multiple monitor support, and remoting. On non-Microsoft platforms, remote desktop protocols are also implemented.

Advantages:

Using the RDP has the following advantages are following,

• Faster developments:

On the client device, faster application and desktop installation are not required. In the widespread remote desktop, protocol support means enables you to use any device that is connected to your desktop’s windows.

• Strong security:

It avoids the security issues that are created from unsecured data from outside your network. rules that are set up prevent the users from storing data in flash drives and in devices.

• Decrease downtime:

Cloud storage means it decreases downtime in case of failure of devices. Users are not limited to the devices they can use many devices to access their VMs.

• Cheap:

Based on the demand computer resources are assigned to devices. This means a lower total cost value since the devices without the processing power can still use without upgrading them.

• More devices:

Window-based applications are transferred to non-window devices such as android, iOS, and thin client.