ARP! Tell your network to explain itself
ARP! Tell your network to explain itself
Hello there! So, I can never remember what IP addresses I have given to devices on my network, or which IP my router has assigned to each one. Recently I’ve been learning about ARP (or Address Resolution Protocol) and tools like arp-scan, and I wanted to share how cool it is! That’s arp-scan listing every device on my network with its IP, its MAC address, and, most helpful of all, the manufacturer. Here’s how the thing works.
你好！我总是记不住我给网络中的设备分配了哪些 IP 地址，或者路由器给每个设备分配了什么 IP。最近我一直在学习 ARP（地址解析协议）以及像 arp-scan 这样的工具，我想分享一下它有多酷！arp-scan 可以列出我网络中的每个设备及其 IP、MAC 地址，最有用的是，它还能显示制造商。下面是它的工作原理。
So here’s the story. In your local network, when you want to send a message to a device, you need both its IP address and its MAC address. Why would you need two addresses, you ask? That’s a great question, and answering it fully would make this post longer than I want it to be. The briefest answer is that your network switch doesn’t speak IP. All it knows is which devices (identified by their MAC address) are connected to which port. When it receives a packet (technically a frame, but I digress) addressed to some MAC, it forwards it out the physical port that device is plugged into. That’s it, that’s the bulk of switches’ work!
故事是这样的。在局域网中，当你想要向某个设备发送消息时，你需要它的 IP 地址和 MAC 地址。你可能会问，为什么需要两个地址？这是一个好问题，但要完整回答它会让这篇文章变得太长。最简短的回答是：你的网络交换机并不“说” IP。它只知道哪些设备（通过 MAC 地址识别）连接到了哪个端口。当它收到一个发往某个 MAC 地址的数据包（严格来说是帧，但我跑题了）时，它会将其转发到该设备所连接的物理端口。就是这样，这就是交换机的主要工作！
Anyway, I bet you’ve never typed ping AA:BB:CC:DD:EE:FF either. Ain’t nobody got time for that! ping only takes an IP, so how does your computer know the MAC address for 192.168.88.140 when you ping it? Well, it asks, literally! Take a look at this conversation in Wireshark: Even though I only ran a ping command, some communication happens first, and that’s ARP. It all starts with my computer asking everybody on the network, “Hey, who has 192.168.88.140?” That message is broadcast, meaning it’s sent to every device on the network.
总之，我敢打赌你从来没输入过 ping AA:BB:CC:DD:EE:FF。没人有时间做那种事！ping 命令只接受 IP 地址，那么当你 ping 192.168.88.140 时，你的电脑是如何知道它的 MAC 地址的呢？答案是：它会直接询问！看看 Wireshark 中的这段对话：即使我只运行了一个 ping 命令，在此之前也会发生一些通信，那就是 ARP。这一切始于我的电脑询问网络上的所有人：“嘿，谁拥有 192.168.88.140？”这条消息是广播发送的，意味着它会被发送到网络上的每一个设备。
My network is well behaved, so only the right recipient answered: my Xerox printer, saying, “I have 192.168.88.140, and my MAC address is …” (My workstation has an AsRock motherboard, if you’re wondering where the source MAC came from.) With that, my computer has everything it needs to send the ping with both the IP and the MAC in the packet. As your computer talks to other devices on the local network, it builds a list of all the neighbors it knows. On Linux you can see that list with ip neighbour show. If you want to watch your computer ask for the MAC of a neighbor it doesn’t know, you can make it forget everything with sudo ip neighbour flush all.
我的网络运行良好，所以只有正确的接收者做出了回应：我的施乐打印机回复说：“我有 192.168.88.140，我的 MAC 地址是……”（如果你好奇源 MAC 地址是从哪来的，我的工作站用的是华擎主板。）有了这些信息，我的电脑就拥有了发送 ping 所需的一切，数据包中同时包含了 IP 和 MAC 地址。当你的电脑与局域网中的其他设备通信时，它会建立一个已知邻居的列表。在 Linux 上，你可以通过 ip neighbour show 查看该列表。如果你想观察电脑如何询问它不认识的邻居的 MAC 地址，你可以使用 sudo ip neighbour flush all 让它忘记所有记录。
This mechanism has some interesting consequences. What if I have an impostor who claims to be 192.168.88.1? Good question. Look up ARP spoofing. 😉 Also, every device receives that broadcast. What if a misbehaving device sends broadcast messages nonstop? Look up broadcast storms, and be responsible with what you learn! 😎 That’s ARP in a nutshell. Next time your network feels like a mystery, just ask it.
这种机制带来了一些有趣的后果。如果有一个冒充者声称自己是 192.168.88.1 会怎样？问得好。去查查 ARP 欺骗吧。😉 此外，每个设备都会收到广播。如果一个行为不端的设备不停地发送广播消息会怎样？去查查广播风暴，并对你所学到的知识负责！😎 这就是 ARP 的简要介绍。下次当你的网络让你感到困惑时，直接问它就行了。