Arpchat – Text your friends on the same network using just ARP

https://github.com/kognise/arpchat

by louismerlin • 3 years ago

469 71 3 years ago

github.com

hk1337• 3 years ago

I did this with "net send" back in high school and got in trouble.

hiatus• 3 years ago

I don't think "net send" uses ARP as you had to be connected to a domain iirc.

e12e2• 3 years ago

Uses/used NetBIOS in various guises - no ARP.

yarekt• 3 years ago

Haha those were the days. Accidentally (on purpose) sent a message to entire domain in college, IT teachers immediately looked to us trouble makers :D

greenie_beans• 3 years ago

was just thinking about the same thing but they didn't catch me!

junon2• 3 years ago

Unless the network analyzer cared about malformed or weird ARP packets (which it probably doesn't) then ARP messaging would probably be undetectable.

huhtenberg• 3 years ago

`write` sends its regards.

https://en.wikipedia.org/wiki/Write_(Unix)

Terr_• 3 years ago

I found that trick and showed it to some friends... But it's hard to keep a secret, and somehow a larger non-friend group was using it to cheat in a computer-lab class. I was offended by the blatant cheating, and a little by the idea that certain people I didn't particularly like were profiting from what I'd found.
So I spoofed the system administrator's username (not hard on Win9x) and sent off a stern warning, which must've surprised them since suddenly all the messages stopped. :)

archmaster5• 3 years ago

Hey, I made this! I also made this other thing on HN today (https://news.ycombinator.com/item?id=37062422), really cool to see ArpChat as well (guess someone went through my profile). It was a super fun project and I learned a lot about networking.

I actually got a chance to use it in a totally-offline setting a bit ago, which was fun! ... however, I then found a major bug that was causing tons of latency, and I fixed it but I haven't gotten around to building new artifacts yet, so you might want to build from scratch if you're planning on testing it out in a real setting for some reason. I also added fun username colors and message times. I promise I'll upload a new release soon!

If you're interested, I wrote an article about a year ago about how ArpChat works: https://kognise.dev/writing/arp

junon2• 3 years ago

The readme banner at the bottom is absolutely hilarious and beautiful. This is neat, great job!

Brian_K_White• 3 years ago

The banner is win :)

fullstop4• 3 years ago

Do you expect this to work on Linux?

    # sudo getcap ./arpchat 
      ./arpchat cap_net_raw=ep

I receive "error getting channel, might be missing permissions"

edit: the received error is from arpchat, not any of the setcap setup.

archmaster5• 3 years ago

not sure if your formatting is messed up, but these commands should work:

    $ sudo setcap CAP_NET_RAW+ep ./arpchat
    $ ./arpchat

perhaps try sudo on the arpchat binary if not

pmarreck• 3 years ago

I am just grinning like hell going through all this.

Even though ArpChat would probably give network admins a heart attack, your mind is most certainly fucking rad, ma'am. =) I too am the kind of person that read books on OSI layers for funsies, lol. Keep playing with code! Reminds me a bit of justine tunney's work with things like https://justine.lol/ape.html where someone just goes way deep on a thing that few people seem to fully understand (in her case it would be "compiler binary format minutiae" among other things) and then asks a crazy question like "what if it were possible to mesh all the binary formats together into a meta-format that actually runs on all of them?" and then conjures up this crazy thing that actually works.

archmaster5• 3 years ago

justine tunney is an amazing inspiration! glad you enjoyed :)

hiAndrewQuinn3• 3 years ago

Oh heck yeah now this is what I'm talking about! Data link layer shenanigans!!

For that of you who have no idea what the Address Resolution Protocol (ARP) is, to a first approximation it is the missing link between your MAC address (what Ethernet runs on) and your IP address (what Internet runs on). After your IP routing table, which you can see with `route`, decides what immediate next IP address to forward a packet to, then your ARP cache, which you can see with `arp`, will decide which MAC address that IP correspond to (usually your router's local IP address).

Knowing that ARP even exists is considered mild esoterica today, to say nothing of its IPv6 sibling the Network Discovery Protocol. But even though you don't use it much in modern cloud-based deployments, knowing it exists makes your bird's eye view of how the whole network stack works that much more holistic.

tibordp• 3 years ago

Not sure I'd agree about it being esoteric. Understanding or at least knowing about ARP is still very much essential for people in networking. arping is a very useful tool for seeing if machines on the same network segment are up and just not responding to ICMP pings. Anyone looking at tcpdump/Wireshark dumps will run into it sooner or latter.

It is true that software engineers may sooner run into it when debugging their home network than their application though as cloud and traditional networks are very different.

spicyramen_• 3 years ago

ARP is very common knowledge for people with basic Linux, networking skills. Back in 1990s, early 2000s was a very common tool for LAN troubleshoot

rkagerer• 3 years ago

If it really is becoming obscure that's a shame, I'm not sure how you could pretend to understand how IP networks work without having at least cursory familiarity with it.

ianlevesque• 3 years ago

Well, it's like a series of tubes...

necrophcodr• 3 years ago

If I was hiring a network technician, I definitely wouldnt hire someone who didn't know what ARP is. It's too easy and fundamental to the field. It took all of like 3 weeks at the trade school I attended to cover IPv4, MAC, ARP, basic routing protocols, TCP, and UDP, and we were definitely chilling. Understanding those things isn't complicated. You just need to know what computers are, and what "networks" are, then it all very easily clicks into place.

themoonisachees• 3 years ago

I had a job interview today and they asked me to describe TCP and udp, and when I did they told me not everyone knows it nowadays. I guess I can see why, if you're a web dev you never have to worry about such things.

TacticalCoder• 3 years ago

Knowing that ARP even exists is considered mild esoterica today

And you can, say, hardcode the ARP entries from other computers on your network when they have fixed IP addresses.

pcthrowaway2• 3 years ago

For that of you who have no idea what the Address Resolution Protocol (ARP) is, to a first approximation it is the missing link between your MAC address (what Ethernet runs on) and your IP address (what Internet runs on)

More commonly, this is 802.11 nowadays, though I guess ARP would be used at any data link layer protocol when the host needs to get an IP: https://en.wikipedia.org/wiki/Data_link_layer

nextaccountic• 3 years ago

so you don't use arp when you connect through wifi?

but if you have a wired connection and a wifi connection to the same router, will one use arp and the other not use it?

jandrese2• 3 years ago

This may be even more fun than you expect. We were doing VLANs using hardware from a major vendor to partition a network and discovered that while the VLANs worked most of the time, they were leaky with ARP traffic. It was causing us headaches because the machines were supposed to be sending all of their traffic through the router, but sometimes they were seeing ARP replies that they shouldn't and were thinking that the other machines would be reachable directly, causing them to be unable to send traffic until the ARP cache entry timed out. We couldn't get the vendor to show any interest in fixing the bug either, because they were too big to care.

It's possible this chat app could break through VLANs in certain circumstances.

archmaster5• 3 years ago

From my testing, it can break through a lot of things!

brirec• 3 years ago

This is interesting to me for basically the same reason — being able to send and receive ARP messages with arbitrary payloads would definitely make troubleshooting VLANs (and other L2 connectivity) easier!

jandrese2• 3 years ago

Check out arping[1].

But it is easy to send out arbitrary ARP requests using almost anything and watch them with Wireshark.

[1] https://man7.org/linux/man-pages/man8/arping.8.html

catboybotnet• 3 years ago

Haha, this is amazing. Going to see if I'll get caught using this later today. :)

jedahan• 3 years ago

I love (ab)using protocols that are built-in to most OS'. I wrote a dumb fake samba share that let people see messages in Finder.app/Explorer.exe/Gnome/KDE since I couldn't find a cross-platform gui or cli messaging system that didn't require installing special client software. (even netcat invocations were not working when trying on our local network, and had OS-specific flag differences if we wanted to do broadcast).

You see the samba share message in your file browser, click it and can edit the filenames to update a 3-line "bulletin board".

https://github.com/jedahan/samba-haiku/blob/master/index.js

Even this was a re-implementation that used WIFI ssids to make a captive portal haiku.

https://github.com/jedahan/haiku-wifi

gorkish• 3 years ago

It's fun that it abuses ARP's ability to include an arbitrary payload, but just to remind everyone of networking 101, thing that the author is relying on is just the simple fact that switches flood packets addressed to ff:ff:ff:ff:ff to the entire broadcast domain. You can achieve similar message flooding without having to have superuser/raw packet permissions by directing packets to the L3 broadcast address whereupon they will (usually) be L2 flooded (Aka it's fun to ping the broadcast address.)

Using ARP doesn't offer any particular advantage, and I would note since many modern switches do thinks like snooping arp packets, putting a high amount of bogus ARP traffic on the network could actually have some negative impact. It's still fun at any rate and reminds me of the type of crap that I used to make when I was learning. As alluded to before, I personally would have chosen to abuse ICMP for this purpose; maybe it's a future avenue for development. Kudos to the fun project!

omitmyname• 3 years ago

Are you referring to https://hpbn.co/?

inopinatus2• 3 years ago

One of the first amplification DDoS attacks I ever saw - talking 1990s era - was to ping the broadcast addresses of unwitting campus networks with the victim’s host address spoofed as the source.

This shouldn’t work today, but back then, a naive TCP/IP implementation (which is to say, many of them) would happily participate.

lokar• 3 years ago

https://en.m.wikipedia.org/wiki/Smurf_attack

jerf• 3 years ago

It uses another important Networking 101 principle: It's All Just Numbers.

ARP, DNS, HTTP, TLS, on the one hand they really are the things that may pop into your head when you think about those things, but they are also simultaneously Just Numbers. ARP has access to the same numbers as HTTP. UDP doesn't get access to 11-bit bytes. DNS does not have special CPU instructions only it gets access to. It's All Just Numbers. And in the end you can stuff whatever numbers you like onto the line and the rest of the world is just going to take those numbers and do... whatever they do with them.

cyberax• 3 years ago

Ah, good old days of NetBEUI are finally returning!

teddyh• 3 years ago

If you’re limiting yourself to the local network, why use IP at all, when you could use CHAOSNET?

IgorPartola• 3 years ago

Back when IPv4 NAT was sort of standard (still is but so is IPv6 as well as GCNAT now), I created a thing I called NATChat. It would basically just create a chat room for you based on your public IPv4 address, allowing you to chat with anyone on your network. Was kinda neat to use in office with others (back when that was also a thing).

lyapunova• 3 years ago

This is a great and fairly accessible project. I'd like to give this a shot at my local hackerspace!

bgorman• 3 years ago

It is also possible to configure device IP addresses directly with ARP https://jetdirect.printerdepo.com/en/hp-jetdirect-print-serv...

bdavbdav2• 3 years ago

This isn’t configuring the device IP as such - more just faking an IP address for it temporarily on a single client.

prgt• 3 years ago

Other similar in c++: https://github.com/gbonacini/arpchatcpp

vlan0• 3 years ago

This is neat! Might get your interface disabled though in my network. I rate limit ingress ARP on access ports. :)

jiveturkey• 3 years ago

super neat.

I also described ARP as a layer 3 protocol. There’s some contention on this — while I think this is the most accurate and easiest explanation, networking is more nuanced than the OSI model might convey. Some would describe ARP as a level 2 or even level 2.5 protocol. For our purposes, I believe calling it level 3 makes the most sense.

TCP/IP doesn't follow the OSI model, so the nuance of OSI isn't directly applicable. ARP is practically defined (ref Stevens) as being in layer 2.5 (of the TCP/IP model), so i believe calling it 2.5 would make the most sense.

and i mean, ARP frames aren't routable. so they clearly aren't L3.

anotherevan2• 3 years ago

My wife, kids and I all work or study mostly from home, so often all on our computers in our separate crates^H^H^H^H^H^Hrooms. We use Beebeep to be able to message back an forth when needed. It doesn't need a server and has both Linux (me) and Windows (everyone else) clients which was the deal clincher.

It works pretty well, although sometimes you have to restart after your laptop wakes up before it sees others on the LAN. That and not being able to open a message window to someone direct from the tray icon are really my only grips. Can cut and paste pictures (of funny cats) and even send files and other capabilities I've never used. (This is not a paid advertisement, I've just started rambling.)

https://www.beebeep.net/

bdavbdav2• 3 years ago

I think the beauty of this is not the messaging itself, but the abuse of a low level network protocol to jump outside client isolation etc.

anotherevan2• 3 years ago

Oh, agreed. Just while reading about it, it made me think of Beebeep so thought I'd give it a quick review in case anyone else was reading thinking, "I could use something like that."

zackify• 3 years ago

Now I want to try making a chat system where you just query a dns txt record on a set polling interval

willsmith72• 3 years ago

I don't know much about networking...

I've been to ski resorts where there's no phone reception, and I love it that way. No one's on their phones. But it's easy to lose someone for an entire day (or until your agreed meeting time).

Is it possible to use something like this to setup a wireless network which would facilitate chat without a connection to the outside world?

Ok now that I typed it it sounds crazy but I always thought this should be possible

post-it• 3 years ago

There's a similar app designed for cruises, where you can talk peer-to-peer over the ship's wifi without actually being online. It could work if you have a wifi antenna with you.

joeframbach• 3 years ago

Recently my wife and I had separate seats in an airplane and we didn't want to pay for texting. I thought about how I could set up my phone as a hotspot with a captive portal which just presents a chat interface. Nothing came of it, but it was something interesting to think about on a flight, at least.

timeon• 3 years ago

I vaguely remember commercial from 90s. It was Ericsson? phone that could message to another nearby Ericsson phone even without GSM. Or was it Nokia? Google gives my just recent products.

eimrine• 3 years ago

Seems like PTT but I could not manage this thing to work on any Nokias I owned.

iamthejuan• 3 years ago

I did something similar to this before in my old job, because installing of chat applications is unauthorized, the solution I come up with is I created a batch script with easily to identify computer network map so regular users will have problem using it, it utilizes net send command.

conradfr2• 3 years ago

That's fun!

That reminds me of a chat software that I did in Delphi 3 back in 1999/2000 (being not that much older than OP) for our LAN parties, that was basically broadcasting on 255.255.255.255 [0]

It was inspired by Kali (remember Kali? [1]) and IRC.

I think it worked until we moved from hubs to switches ;)

Keep on coding! :)

[0] https://i.imgur.com/IPGPaae.png

[1] http://www.tweak3d.net/articles/kali/images/bigchat.jpg

e12e2• 3 years ago

broadcasting on 255.255.255.255 (...) I think it worked until we moved from hubs to switches ;)

Should work fine on switched network (like DHCP) ? - but won't cross subnets.

Ed: maybe some of you moved to wireless - and some stayed on a different cabled subnet?

conradfr2• 3 years ago

You may be right, the details are quite fuzzy ;)

I don't even understand the network code all that much (actually written by a friend) but it does use INADDR_ANY, INADDR_BROADCAST and SO_BROADCAST.

edit: Tried it on two old Windows 7 computers on my mixed rj45 / wifi home network and some chat data are received by the other party and some don't, or it crashes. Fun.

edit2: Actually works great on a version where I could set a specific broadcast address like 192.168.1.255.

lsofzz• 3 years ago

Déjà vu I wrote an implementation that _exactly_ did this PoC a decade ago.

Modern network protocols have so much extra reserved bits that you can add pretty much anything want in it; keep going ;)

Arpchat – Text your friends on the same network using just ARP

Related Stories