Lesson 2.3: MAC addresses, Ethernet and ARP
How devices find each other inside one local network: Ethernet frames, 48-bit MAC addresses and the manufacturer prefix in them, broadcast, randomised MAC addresses on phones, and ARP, the protocol that turns an IP address into a MAC address, with the attack that abuses it. In the lab you read your MAC, look up who made the devices around you, watch ARP questions and answers in a capture, and catch a machine that claims to be the router.
18 min
You will learn to
- Explain Ethernet frames and MAC addresses
- Find a device's manufacturer from its MAC prefix
- Explain broadcast and randomised MAC addresses
- Explain how ARP maps IP addresses to MAC addresses
- Recognise ARP spoofing in a capture
Key terms
- Ethernet
- The most common family of standards for wired local networks: how bits travel on the cable and how frames are built.
- Frame
- The unit of data at layer 2: a packet wrapped with source and destination MAC addresses and a checksum.
- MAC address
- A 48-bit hardware address, written as six hexadecimal bytes. The first three bytes (the OUI) identify the manufacturer.
- Broadcast
- A message sent to every device on the local network at once. Its MAC address is ff:ff:ff:ff:ff:ff.
- Randomised MAC address
- A made-up, locally administered MAC a device uses instead of its real one, to protect privacy.
- ARP
- Finds the MAC address that belongs to an IP address on the local network: 'who has 192.168.1.20?' 'It's me, at 00:1b:a9…'.
- ARP spoofing
- Sending fake ARP answers so that others link a trusted IP (usually the router) to the attacker's MAC, and send their traffic through the attacker.
← Introduction to the command line · All lessons · The attack surface: every door into a system →