Search code examples
pythonscapyarpspoofing

Why binding pdst with the target ip address and binding a broadcast mac address instead of the target mac address

In 'The Black Hat Python' book page number 53 the restore_target. Why We specify the ip address of the gateway and not specifying its mac address ? I mean if we're going to broadcast our ARP packet then why give pdst value of a specific ip address instead of a broadcast ip address like the hwdst ? ? 

send(ARP(op=2, psrc=gateway_ip, pdst=target_ip, hwdst="ff:ff:ff:ff:ff:ff",hwsrc=gateway_mac),count=5)
Solution

  • What you're sending here is called a Gratuitous ARP. It's a special kind of packets, defined by the fact that the destination Mac is ff:ff:ff:ff:ff:ff.

    Have a look at: https://www.practicalnetworking.net/series/arp/gratuitous-arp/

    The difference is that it is an answer packet, even if there was no request packet. It's "gratuitous". In your case, you are sending a packet mapping psrc to hwsrc, sent to everyone: the router is advertising his MAC to everyone.

    In this case, pdst has little meaning, but it should be set by convention to the same address than psrc. I don't know why it was different in your example.