- Observe that:
- Only
R1 can
tunnel
IP packet to the
mobile host
- Only
R1 can
tunnel
IP packet to the
mobile host
- Therefore:
- We want the
router R2 to
forward
all IP packets
destined for the
mobile host to
router R1:
- We want the
router R2 to
forward
all IP packets
destined for the
mobile host to
router R1:
- Solution:
(using proxy ARP !!!)
- When a router
receives
a CareOf message
for a host X
The router must also:
- Answer the ARP requests for the host X !!!
- When a router
receives
a CareOf message
for a host X
- Example:
- Router R2
sends an
(broadcast) ARP request
for
10.0.0.4:
- Because Router R1
is "CaringOf"
the mobile host
10.0.0.4:
- Router 1 will answer the ARP request with its own Ethernet Address !!!
Graphically:
- When router R2
receives the
ARP response:
- Router R2 will send the IP packet (destined for 10.0.0.4) using router R1's Ethernet Address !!!
Graphically:
- Result:
- The IP packet is delivered to the home agent
When the home agent (R1) receives the IP packet:
- The home agent (R1) will tunnel the IP packet to the mobile host (like before) !!!
--- because its forwarding table entry for 10.0.0.4 is virtual
- Router R2
sends an
(broadcast) ARP request
for
10.0.0.4:
- Proxy ARP:
- Proxy ARP = an ARP response issued on behalve of another node
The ARP response from the home agent is an proxy ARP !!!
- To act
on behalf
of someone else
is known as a proxy:
Word: proxy proxy \'pra:k-se-\ n [ME procucie, contr. of procuracie, fr. AF, fr. ML procuratia], alter. of L procuratio procuration 1: the agency, function, or office of a deputy who acts as a substitute for another 2a: authority or power to act for another 2b: a document giving such authorization; specif : a power of attorney authorizing a specified person to vote coporate stock 3: PROCURATOR - proxy aj
- Security warning:
- Proxy ARP poses a security problem for network administrators !!!
-
Misuse of
proxy ARP:
- One computer
can claim
to be
another computer
- The attacker can
intercept
IP apcket
destined for
the other computer !!!
This action is called spoofing
- One computer
can claim
to be
another computer