Bugtraq mailing list archives

Re: Buggy ARP handling in Windoze


From: jurjen () STUPENDOUS ORG (Jurjen Oskam)
Date: Thu, 29 Jun 2000 21:48:26 +0200


On Thu, 29 Jun 2000 18:50:44 +0200, Paul Starzetz <paul () STARZETZ DE>
wrote:

I discovered a strange bug in the ARP handling under Windows 98/latest
Winsock patch (IGMP). Win98 (at almost Win95 as far as tested) would not
handle static ARP entries correctly. Setting up an static ARP cache
entry like:

c:\windows\arp.exe -s host_ip host_mac

I think this is a 'feature' - at least I read here in a preparation
guide for the Microsoft TCP/IP exam that "a static entry in the ARP
cache changes if an ARP broadcast that indicates a different hardware
address is received. In this case, the type of the entry changes to
dynamic, and the newly received hardware address replaces the current
one."

This is not official Microsoft-documentation, but it *is* from a
"Microsoft approved study guide", so it's what Microsoft teaches their
MCPs and MCSEs.

-- 
    Jurjen Oskam * ICQ 11573303 * http://www.stupendous.org/ for PGP key
assassinate nuclear iraq clinton kill bomb USA eta ira cia fbi nsa kill
president wall street ruin economy disrupt phonenetwork atomic bomb sarin
nerve gas bin laden military -*- DVD Decryption at www.stupendous.org -*-



Current thread: