Networking
18 June 2011 0 Comments

An Introduction to ARP Cache Poisoning

Other posts in the ARP series: The ARP protocol explained, Viewing and manipulating the ARP cache on Windows and Linux

Remember that each network interface maintains a table of (IP->MAC) mappings in its ARP cache. The ARP protocol packet has the following structure:

Structure of an ARP packet

There are two types of ARP packets: request and reply. The type is determined by the Operation Code field. The tabel below shows a scenario of normal operation:

  • Host A sends an ARP request looking for the MAC address of Host B
  • Host B responds with ARP reply.

This ARP packet is encapsulated in an Ethernet frame with the following values:

Normally an ARP request is sent because the sender wants to talk to a given IP address and needs to find out the associated MAC address. But sometimes the sender generates an ARP packet to inform the receivers about some information, instead of asking for information. This is called gratuitous ARP and is commonly used in the following situations:

  • Duplicate address detection
  • Change of MAC address
  • Virtual IP

Routers and other network hardware may cache routing information gained from multiple gratuitous ARP packets. Read this page for more information. For gratuitous…

Tags: , , , , , gratuitous, poisoning, reply, request, unsollicited
Windows
23 January 2011 0 Comments

Windows 7 – “Folder In Use” Error on Mounted Network Shares

The “Folder in Use” error occurs when a network share on a remote computer is mounted as a disk in Windows Explorer on Windows 7. This post explains how to resolve it.

Problem:

You have mounted a remote network share on your computer, with write access. When moving folders around in the share you get the “Folder In Use” error.

Looking at the opened file handles on the server that hosted the share, you will probably see the ‘Thumbs.db’ files are being written to. This means Windows Explorer is generating Thumbs.db files in the share–which are thumbnail cache files used by Windows Explorer.

Solution:

Completely disabling the use of ‘Thumbs.db’ files will prevent the problem from occurring:

  1. Open the Group Policy Editor (Start -Run -‘gpedit.msc’)
  2. Set to Enabled:
    User Configuration Administrative Templates Windows Components Windows Explorer Turn off the caching of thumbnails in hidden thumbs.db files
  3. Reboot

A good thread about the same subject can be found here.…

Tags: , explorer, folder in use, gpedit.msc, in use, , thumbnails, thumbs, thumbs.db