工業(yè)以太網(wǎng)的通訊奧秘任務：揭秘ARP任務引入任務引入任務引入ARP初識ARP01ARP解析原理02ARP病毒03攻破ARP病毒04目錄CONTENTS頭腦風暴0501初識ARPPC觸摸屏PLC交換機發(fā)送端接收端星型結(jié)構(gòu)01PC觸摸屏PLC交換機發(fā)送端接收端應用層協(xié)議數(shù)據(jù)單元（PDU）程序協(xié)議數(shù)據(jù)段Segment端口號網(wǎng)絡層報文/數(shù)據(jù)包PacketTCP/IP協(xié)議數(shù)據(jù)鏈路層交換機數(shù)據(jù)幀F(xiàn)rame物理層集線器比特Bit知IP惑MAC依賴MAC初識ARP星型結(jié)構(gòu)01ARP（AddressResolutionProtocol，地址解析協(xié)議）初識ARPICMPIGMP網(wǎng)絡地址IP網(wǎng)絡層ARP硬件地址MAC01初識ARP字段11，MAC地址未知用0表示字段1，為獲得某個IP地址的MAC地址進行廣播觸摸屏PLCPC02ARP原理P1P5P8IP地址MAC地址192.168.1.18192.168.1.5800:1B:1B:21:B6:A0HMI：網(wǎng)絡層ARP表192.168.1.1828:63:36:E9:6D:2C192.168.1.5800:1B:1B:21:B6:A0192.168.1.1694:C6:91:76:15:01ARP表：反映IP地址與MAC地址的關(guān)系。？？？觸摸屏PLCPC02P1P5P8IP地址MAC地址192.168.1.18192.168.1.5800:1B:1B:21:B6:A0HMI：網(wǎng)絡層ARP表192.168.1.1828:63:36:E9:6D:2C192.168.1.5800:1B:1B:21:B6:A0192.168.1.1694:C6:91:76:15:01廣播ARP請求：通過廣播查詢IP對應MAC地址。？？？源IP：192.168.1.58目的IP：192.168.1.18源MAC：00:1B:1B:21:B6:A0目MAC：00:00:00:00:00:00ARP請求ARP原理觸摸屏PLCPC02P1P5P8IP地址MAC地址192.168.1.18192.168.1.5800:1B:1B:21:B6:A0HMI：網(wǎng)絡層ARP表192.168.1.1828:63:36:E9:6D:2C192.168.1.5800:1B:1B:21:B6:A0192.168.1.1694:C6:91:76:15:01源IP：192.168.1.58目的IP：192.168.1.18MAC學習：交換機對MAC地址進行學習，解析端口與MAC地址的關(guān)系。源MAC：00:1B:1B:21:B6:A0目MAC：00:00:00:00:00:00P1P5P8交換機：數(shù)據(jù)鏈路層MAC表ARP請求？？？00:1B:1B:21:B6:A028:63:36:E9:6D:2C94:C6:91:76:15:01ARP原理觸摸屏PLCPC02P1P5P8IP地址MAC地址192.168.1.18192.168.1.5800:1B:1B:21:B6:A0HMI：網(wǎng)絡層ARP表192.168.1.1828:63:36:E9:6D:2C192.168.1.5800:1B:1B:21:B6:A0192.168.1.1694:C6:91:76:15:01源IP：192.168.1.58目的IP：192.168.1.18MAC表：交換機端口與該端口所連設備MAC地址的對應關(guān)系。源MAC：00:1B:1B:21:B6:A0目MAC：00:00:00:00:00:00P1P5P8交換機：數(shù)據(jù)鏈路層MAC表00:1B:1B:21:B6:A028:63:36:E9:6D:2C94:C6:91:76:15:01ARP請求？？？ARP原理觸摸屏PLCPC02P1P5P8IP地址MAC地址192.168.1.18192.168.1.5800:1B:1B:21:B6:A0HMI：網(wǎng)絡層ARP表192.168.1.1828:63:36:E9:6D:2C192.168.1.5800:1B:1B:21:B6:A0192.168.1.1694:C6:91:76:15:01P1P5P8交換機：數(shù)據(jù)鏈路層MAC表00:1B:1B:21:B6:A028:63:36:E9:6D:2C94:C6:91:76:15:01IP地址MAC地址192.168.1.18PLC：網(wǎng)絡層ARP表地址不匹配，丟包單播ARP響應報文：包含了自己的MAC地址。28:63:36:E9:6D:2C00:1B:1B:21:B6:A0192.168.1.58源IP：192.168.1.58目的IP：192.168.1.18源MAC：00:1B:1B:21:B6:A0目MAC：00:00:00:00:00:00ARP請求？？？檢測匹配ARP原理觸摸屏PLCPC02P1P5P8IP地址MAC地址192.168.1.18192.168.1.5800:1B:1B:21:B6:A0HMI：網(wǎng)絡層ARP表192.168.1.1828:63:36:E9:6D:2C192.168.1.5800:1B:1B:21:B6:A0192.168.1.1694:C6:91:76:15:01P1P5P8交換機：數(shù)據(jù)鏈路層MAC表00:1B:1B:21:B6:A028:63:36:E9:6D:2C94:C6:91:76:15:01IP地址MAC地址192.168.1.18PLC：網(wǎng)絡層ARP表28:63:36:E9:6D:2C00:1B:1B:21:B6:A0192.168.1.58源IP：192.168.1.18目的IP：192.168.1.58源MAC：28:63:36:E9:6D:2C目MAC：00:1B:1B:21:B6:A0ARP響應源IP：192.168.1.58目的IP：192.168.1.18源MAC：00:1B:1B:21:B6:A0目MAC：00:00:00:00:00:00ARP請求28:63:36:E9:6D:2C？？？ARP原理02廣播請求單播接收暫緩保存主機將包含目的IP地址信息的ARP請求廣播到網(wǎng)絡中的所有主機單播接收返回消息，以確定目的IP地址對應的MAC地址存入本機ARP緩存表中保留一定時間，以便下次請求時直接查詢ARP緩存以節(jié)約資源ARP原理IP地址沖突：同一個局域網(wǎng)內(nèi)，出現(xiàn)兩臺或多臺設備的IP地址相同的現(xiàn)象。

危害：主機混淆，無法下載程序，甚至網(wǎng)絡癱瘓。02ARP原理觸摸屏PLCPCP1P5P8192.168.1.5828:63:36:E9:6D:2C192.168.1.5800:1B:1B:21:B6:A0192.168.1.1694:C6:91:76:15:01廣播ARP請求IP地址MAC地址192.168.1.16主機PC：網(wǎng)絡層ARP表94:C6:91:76:15:01ARP緩存表存在競爭192.168.1.58源IP：192.168.1.58目的IP：192.168.1.16源MAC：00:1B:1B:21:B6:A0目MAC：94:C6:91:76:15:01觸摸屏ARP響應源IP：192.168.1.58目的IP：192.168.1.16源MAC：28:63:36:E9:6D:2C目MAC：94:C6:91:76:15:01PLC的ARP響應02ARP原理02觸摸屏ARP原理P4黑客PC2：惡意篡改ARP表觸摸屏PLCPC1P1P5P8192.168.1.1828:63:36:E9:6D:2C192.168.1.5800:1B:1B:21:B6:A0192.168.1.1694:C6:91:76:15:01192.168.1.66fd:18:46:42:ed:84偽裝成PC1廣播ARP請求源IP：PC1目的IP：PLC源MAC：PC2目MAC：全0ARP請求IP地址MAC地址192.168.1.18PLC的ARP：28:63:36:E9:6D:2CPC2的MAC地址PC1的IP地址03ARP病毒被欺騙篡改ARP病毒：惡意篡改ARP表中的IP地址或MAC地址，從而竊取信息。觸摸屏PLCPC1P1P5P8192.168.1.1828:63:36:E9:6D:2C192.168.1.5800:1B:1B:21:B6:A0192.168.1.1694:C6:91:76:15:01192.168.1.66fd:18:46:42:ed:84P4偽裝成PC1廣播ARP請求源IP：PLC目的IP：PC1源MAC：PLC目的MAC：PC2PLC發(fā)送給PC1成功盜取PC1的數(shù)據(jù)，雖然地址與自身IP不匹配，不丟包截取數(shù)據(jù)03ARP病毒黑客PC2：ARP盜取信息被竊取IP地址MAC地址192.168.1.18PLC的ARP：28:63:36:E9:6D:2CPC2的MAC地址PC1的IP地址被篡改ARP病毒：惡意篡改ARP表中的IP地址或MAC地址，從而竊取信息。04破解ARP病毒（1）可防御ARP攻擊的三層交換機，綁定端口MAC-IP破解方法破解方法（2）合理劃分VLAN，縮小IP、MAC地址盜用范圍，有效隔離ARP攻擊04破解ARP病毒觸摸屏PLCPC1P1P5P8192.168.1.1828:63:36:E9:6D:2C192.168.1.5800:1B:1B:21:B6:A0192.16