Spoofed Gratuitous Arp & multiple MAC entries in the ARP table

[wardwolfram]

I am reading the CCNAv7 materials within the Security chapter, specifically the 'Spoofed Gratuitous ARP Replies.

The logic makes sense but the diagram to this attack leads me to other questions:

1. When an attacker sends gratuitous ARP replies (which are broadcast messages) to PC-A and the router R1, does not both devices have multiple entries in their arp tables using duplicate MAC address of the attacker?

2. If multiple duplicate MAC address entries are permitted in the devices ARP table, would this break any arp table functionality?

Thanks,

[MHM Cisco World]

..

[Jon Marshall]

It is not added as a duplicate, it overwrites the existing entry so there is no duplicate entry for the same IP address. 

Jon

[wardwolfram]

I am concerned about the duplicate MAC addresses created in an ARP table from a gratuitous ARP reply (not ip addresses).

[MHM Cisco World]

...

[Jon Marshall]

I don't follow. 

A mac address maps to an IP address so there can't be multiple mac address entries for the same IP because as I say it is overwritten. 

Jon

[Richard Burts · Accepted solution]

I am focusing on this statement from the original poster "I am concerned about the duplicate MAC addresses created in an ARP table from a gratuitous ARP reply (not ip addresses)." If I am interpreting this correctly the concern is not about multiple entries for the same IP, but is concern that multiple IP addresses in the table might have the same mac address. Indeed this can easily happen and it is NOT necessarily a problem.

Let me describe an example of how this could happen: assume that a router is configured with this static default route

ip route 0.0.0.0 0.0.0.0 G0/0

The router would accept this as valid. Since there is no next hop address every time the router is forwarding traffic toward any remote address it will arp for that address. If the upstream router has enabled proxy arp it will respond to the arp request with its own mac address. So on the router if you do show arp there will be many IP entries all of which have the same mac address (which is the mac of the upstream router). 

[Jon Marshall]

Rick 

Agree with what you say but based on the original question about how the attack works I was assuming the OP thought there might be multiple mac address entries for the same IP address which is not the case. 

However you may well be right in that the question was asking something else entirely. 

Jon 

[wardwolfram]

Thank you for the example Richard!

[Richard Burts]

You are welcome. An example frequently is helpful in understanding some of these principles. I am glad that our explanations have been helpful. Thank you for marking this question as solved. This will help other participants in the community to identify discussions which have helpful information. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.

@Jon Marshall I agree that the original question might be understood to be about multiple entries for the same IP address. But the diagram in the question shows multiple IP with the same mac address. And the follow up statement from the original poster which I mentioned was pretty clear that he was concerned with multiple mac entries rather than multiple IP entries being the same.