‫Before talking about using our tables for passive scanning, let's talk a little bit about AAFP protocol
‫and mechanism first.
‫So address resolution protocol AAFP is a network layer protocol used for mapping a network address such
‫as an IP v4 address to a physical address such as a Mac address.
‫To simulate how the AARP mechanism works, we have a small network in the slide, a switch on top and
‫three computers connected to it.
‫Computer wants to talk to computers, see?
‫It puts an ARP request onto the wire, which happens to be broadcast.
‫Essentially what it's saying is who has computers?
‫His Mac address.
‫Of course, because it's a broadcast, every system on the network hears it.
‫Does everybody respond well, what happens is that B hears that A is looking for the Mac address of
‫computers C.
‫B knows that it's not computer C and therefore does not respond to the broadcast.
‫The broadcast, the AAP request goes out to every system, but the only system that will reply is computer
‫see with an AAP reply.
‫In other words, Computer says, who has the Mac address of computer see and although all the workstations
‫here, the question only she replies and says, I've got the Mac address of computer C and this is what
‫it is.
‫So they are purply sends back the Mac address the computer a.
‫And each of these machines start building an ark table.
‫So what is the Ark table?
‫Since computers cannot send broadcast messages every time they need to connect with another network
‫device, they store the IP addresses and the corresponding MAC addresses of systems they frequently
‫communicate with in a table called ARP Table.
‫All the systems in the land maintain this table.
‫The entries in the Aakash table are generally short lived and are updated every 15 to 20 minutes.
‫Now, let's get back to our topic.
‫Can we say that one of the passive scan methods is just looking into the ARP table of a system which
‫is a network that we are scanning?
‫Wow, sure we can.
‫Inside in our table, we see the IP addresses of some of the systems of the network and their corresponding
‫MAC addresses.
‫Let's see the ARP tables in three different platforms, Mac OS, Windows and Debian Linux.
‫We are a Mac OS operating system.
‫First, open the terminal first type terminal in the search box of the applications window, which brings
‫you the terminal application.
‫Typing ERP and hitting enter shows a small help for our common.
‫If you want to see detailed help about the art command, you can use man command type MRN, AARP and
‫hit enter, you'll get detailed help.
‫A parameter is used to display all current ARP table entries, but hold on, it says A is used to delete
‫all entries as well.
‫How can that be?
‫Well, to delete an art table entry, you use D parameter.
‫If you use this parameter with a parameter, you are able to delete all entries of our tables.
‫IE parameter is used to see the entries of a single interface by default.
‫ARP Command tries to show the display addresses symbolically.
‫See the IP addresses instead of display names of the systems, you have to use any parameter.
‫Which means do not resolve names.
‫OK, press cue to quit the man page of the command now type IRP Dash A.N. to see all the entries of
‫the ARP table.
‫Since Mac OS is a BSD based operating system, the results of the command is displayed in VSD style.
‫Sagger machine is a Microsoft Windows eight.
‫Let's open a command prompt first, I have a shortcut on my status bar, so I click it to start a command
‫prompt.
‫Alternatively, press windows, plus are buttons, open the dialog box, run command and hit enter.
‫If you type AARP and a window system, the help page of our command is displayed.
‫Type IRP Dash A to see the entries of the ARP table, in my opinion, this display is more, I don't
‫know, human readable than BSD style.
‫Now, although we're not interested in these at the moment, I would like to talk a little about the
‫IP addresses that start with two to four to calm your curiosity.
‫Due to 4.0, 022 is the multicast address for Internet group management protocol two to four zero zero
‫two five two is used by recent versions of Windows four link local multicast name resolution L.M. and
‫are searching for local network computers.
‫The third machine is our colleague, which is a Debian based Linux operating system.
‫Open the terminal window if you type ERP and hit enter the ARP table entries are displayed in a human
‫readable format.
‫As you see, systems are listed with a known domain name such as w w w oos BW Dotcom by default.
‫AARP dash age brings you a small help page if you want a detailed health page type man, Spatt, AAFP.
‫In a Debian based Linux system, that's a parameter of our command is used to see the entries in BSD
‫format, which we saw in Mac OS, Dash is again to see the entries of a single interface.
‫OK, press cue to quit the man page AARP dash a display's art table entries in BSD format and use any
‫parameter to see the IP addresses instead of domain names of the systems.