Arpchat – Text your friends on the same network using just ARP | Hacker News Reader

Arpchat – Text your friends on the same network using just ARP

github.com

469 pointslouismerlin71 comments

Hey, I made this! I also made this other thing on HN today (https://news.ycombinator.com/item?id=37062422), really cool to see ArpChat as well (guess someone went through my profile). It was a super fun project and I learned a lot about networking.

I actually got a chance to use it in a totally-offline setting a bit ago, which was fun! ... however, I then found a major bug that was causing tons of latency, and I fixed it but I haven't gotten around to building new artifacts yet, so you might want to build from scratch if you're planning on testing it out in a real setting for some reason. I also added fun username colors and message times. I promise I'll upload a new release soon!

If you're interested, I wrote an article about a year ago about how ArpChat works: https://kognise.dev/writing/arp

The readme banner at the bottom is absolutely hilarious and beautiful. This is neat, great job!

The banner is win :)

Do you expect this to work on Linux?

    # sudo getcap ./arpchat 
      ./arpchat cap_net_raw=ep

I receive "error getting channel, might be missing permissions"

edit: the received error is from arpchat, not any of the setcap setup.

not sure if your formatting is messed up, but these commands should work:

    $ sudo setcap CAP_NET_RAW+ep ./arpchat
    $ ./arpchat

perhaps try sudo on the arpchat binary if not

That was me showing you that setcap had, in fact, been called. That's why it's the output of getcap.

I tried it with sudo and it also failed with the same message.

I've tried it on an arch-based laptop and a debian-based laptop with the same results.

i see. hmmmmm ... that's not supposed to happen, and it works fine on both nixos and ubuntu for me. may be something funky going on, i'll see if i can take a look sometime soon.

Using the prebuilt binary works. Building from source does not.

By modifying Cargo.toml slightly, I no longer got the same error, which seems to somehow relate to pnet library.

   pnet = "0.34.0"

Interestingly with Arch it worked fine for me before, but with my Pi, I got the permission error, but changing the pnet ver seemed to fix anyway.

This fixed it for me.

Regarding Arch, I updated everything earlier today but I am running the LTS kernel.

If you use SELinux, you might want to check /var/log/audit/audit.log

I am just grinning like hell going through all this.

Even though ArpChat would probably give network admins a heart attack, your mind is most certainly fucking rad, ma'am. =) I too am the kind of person that read books on OSI layers for funsies, lol. Keep playing with code! Reminds me a bit of justine tunney's work with things like https://justine.lol/ape.html where someone just goes way deep on a thing that few people seem to fully understand (in her case it would be "compiler binary format minutiae" among other things) and then asks a crazy question like "what if it were possible to mesh all the binary formats together into a meta-format that actually runs on all of them?" and then conjures up this crazy thing that actually works.

justine tunney is an amazing inspiration! glad you enjoyed :)

Oh heck yeah now this is what I'm talking about! Data link layer shenanigans!!

For that of you who have no idea what the Address Resolution Protocol (ARP) is, to a first approximation it is the missing link between your MAC address (what Ethernet runs on) and your IP address (what Internet runs on). After your IP routing table, which you can see with `route`, decides what immediate next IP address to forward a packet to, then your ARP cache, which you can see with `arp`, will decide which MAC address that IP correspond to (usually your router's local IP address).

Knowing that ARP even exists is considered mild esoterica today, to say nothing of its IPv6 sibling the Network Discovery Protocol. But even though you don't use it much in modern cloud-based deployments, knowing it exists makes your bird's eye view of how the whole network stack works that much more holistic.

Not sure I'd agree about it being esoteric. Understanding or at least knowing about ARP is still very much essential for people in networking. arping is a very useful tool for seeing if machines on the same network segment are up and just not responding to ICMP pings. Anyone looking at tcpdump/Wireshark dumps will run into it sooner or latter.

It is true that software engineers may sooner run into it when debugging their home network than their application though as cloud and traditional networks are very different.

ARP is very common knowledge for people with basic Linux, networking skills. Back in 1990s, early 2000s was a very common tool for LAN troubleshoot

If it really is becoming obscure that's a shame, I'm not sure how you could pretend to understand how IP networks work without having at least cursory familiarity with it.

Well, it's like a series of tubes...

If I was hiring a network technician, I definitely wouldnt hire someone who didn't know what ARP is. It's too easy and fundamental to the field. It took all of like 3 weeks at the trade school I attended to cover IPv4, MAC, ARP, basic routing protocols, TCP, and UDP, and we were definitely chilling. Understanding those things isn't complicated. You just need to know what computers are, and what "networks" are, then it all very easily clicks into place.

I had a job interview today and they asked me to describe TCP and udp, and when I did they told me not everyone knows it nowadays. I guess I can see why, if you're a web dev you never have to worry about such things.

> Knowing that ARP even exists is considered mild esoterica today

And you can, say, hardcode the ARP entries from other computers on your network when they have fixed IP addresses.

> For that of you who have no idea what the Address Resolution Protocol (ARP) is, to a first approximation it is the missing link between your MAC address (what Ethernet runs on) and your IP address (what Internet runs on)

More commonly, this is 802.11 nowadays, though I guess ARP would be used at any data link layer protocol when the host needs to get an IP: https://en.wikipedia.org/wiki/Data_link_layer

so you don't use arp when you connect through wifi?

but if you have a wired connection and a wifi connection to the same router, will one use arp and the other not use it?

802.11 (wifi) uses ARP also.

I meant that it's typically (for end users) the protocol between the wireless interface (MAC) and network gateway (IP) now, rather than:

> the missing link between your MAC address (what Ethernet runs on) and your IP

Oh, I see your point now. Yes, the direct parallel of "MAC is to Ethernet as IP is to Internet" is an imprecise one, intentionally so: I remembered being really confused about Ethernet vs. Internet when I learned all this stuff, and this parallel was another good-enough approximation at the time for me to continue learning.

What follows is non-expert commentary and I probably get several details wrong. But here is my deeper understanding:

In reality, Ethernet is a really old protocol (like Metcalfe started working on it back in 1973), and the way we use it today is very different from the way it was originally imagined. In the original paper, you would hook up say 10 computers to a single giant cable and just have Computer A send data to Computer B by sending that data to _everyone_ and letting anyone who wasn't Computer B just quietly drop the network traffic. That's a really elegant design, in the same way a rock is a really elegant weapon, but these days we usually plug any Ethernet devices we have into an Ethernet switch and that does most of the filtering for us -- moving us from a complete graph where everyone is connected directly to everyone back to a spoke-and-hub design with the switch as the hub. But the original Ethernet _did_ end up using MAC addresses as the way to distinguish Computer A from Computer B, and so the analogy stuck in my brain as a "wrong but useful" model.

Now 802.11, aka wifi, comes right out the box with a spoke-and-hub model. All your traffic goes through your wireless router/switch/modem/whatever it's called. Even when you want to share things with something like BitTorrent or Syncthing on the local network, Computer A's wireless network card doesn't usually directly transfer files to Computer B's wireless network card - it goes from A, to router, to B. There's nothing technical I'm aware of that stops this direct A-B transfer, since we know wireless cards can both pull and push data, but you would have to do some networking legwork to get them to be on the same subnet to do so, which probably involves a lot of manual fiddling with IP addresses or something.

But 802.11 also emerged into a landscape where MAC addresses are ubiquitous, so it still uses ARP to translate between IP and MAC for reasons I'm not entirely sure of (probably practically that MAC addresses change a lot less often than IP addresses to).

The main reason for wireless using MACs and ARPs and the like is it makes it more directly interoperable with wired networks. You can just bridge a LAN directly to a WLAN and expect the clients to not realize they are a different type.

Yeah that also tracks

It's fun that it abuses ARP's ability to include an arbitrary payload, but just to remind everyone of networking 101, thing that the author is relying on is just the simple fact that switches flood packets addressed to ff:ff:ff:ff:ff to the entire broadcast domain. You can achieve similar message flooding without having to have superuser/raw packet permissions by directing packets to the L3 broadcast address whereupon they will (usually) be L2 flooded (Aka it's fun to ping the broadcast address.)

Using ARP doesn't offer any particular advantage, and I would note since many modern switches do thinks like snooping arp packets, putting a high amount of bogus ARP traffic on the network could actually have some negative impact. It's still fun at any rate and reminds me of the type of crap that I used to make when I was learning. As alluded to before, I personally would have chosen to abuse ICMP for this purpose; maybe it's a future avenue for development. Kudos to the fun project!

Are you referring to https://hpbn.co/?

One of the first amplification DDoS attacks I ever saw - talking 1990s era - was to ping the broadcast addresses of unwitting campus networks with the victim’s host address spoofed as the source.

This shouldn’t work today, but back then, a naive TCP/IP implementation (which is to say, many of them) would happily participate.

https://en.m.wikipedia.org/wiki/Smurf_attack

Ah that’s right. It’s been so long I’d forgotten the name. Although I have a feeling it was already a recognised potential vulnerability some years before being packaged as a convenient utility.

It uses another important Networking 101 principle: It's All Just Numbers.

ARP, DNS, HTTP, TLS, on the one hand they really are the things that may pop into your head when you think about those things, but they are also simultaneously Just Numbers. ARP has access to the same numbers as HTTP. UDP doesn't get access to 11-bit bytes. DNS does not have special CPU instructions only it gets access to. It's All Just Numbers. And in the end you can stuff whatever numbers you like onto the line and the rest of the world is just going to take those numbers and do... whatever they do with them.

I love (ab)using protocols that are built-in to most OS'. I wrote a dumb fake samba share that let people see messages in Finder.app/Explorer.exe/Gnome/KDE since I couldn't find a cross-platform gui or cli messaging system that didn't require installing special client software. (even netcat invocations were not working when trying on our local network, and had OS-specific flag differences if we wanted to do broadcast).

You see the samba share message in your file browser, click it and can edit the filenames to update a 3-line "bulletin board".

https://github.com/jedahan/samba-haiku/blob/master/index.js

Even this was a re-implementation that used WIFI ssids to make a captive portal haiku.

https://github.com/jedahan/haiku-wifi

This may be even more fun than you expect. We were doing VLANs using hardware from a major vendor to partition a network and discovered that while the VLANs worked most of the time, they were leaky with ARP traffic. It was causing us headaches because the machines were supposed to be sending all of their traffic through the router, but sometimes they were seeing ARP replies that they shouldn't and were thinking that the other machines would be reachable directly, causing them to be unable to send traffic until the ARP cache entry timed out. We couldn't get the vendor to show any interest in fixing the bug either, because they were too big to care.

It's possible this chat app could break through VLANs in certain circumstances.

From my testing, it can break through a lot of things!

This is interesting to me for basically the same reason — being able to send and receive ARP messages with arbitrary payloads would definitely make troubleshooting VLANs (and other L2 connectivity) easier!

Check out arping[1].

But it is easy to send out arbitrary ARP requests using almost anything and watch them with Wireshark.

[1] https://man7.org/linux/man-pages/man8/arping.8.html

My wife, kids and I all work or study mostly from home, so often all on our computers in our separate crates^H^H^H^H^H^Hrooms. We use Beebeep to be able to message back an forth when needed. It doesn't need a server and has both Linux (me) and Windows (everyone else) clients which was the deal clincher.

It works pretty well, although sometimes you have to restart after your laptop wakes up before it sees others on the LAN. That and not being able to open a message window to someone direct from the tray icon are really my only grips. Can cut and paste pictures (of funny cats) and even send files and other capabilities I've never used. (This is not a paid advertisement, I've just started rambling.)

https://www.beebeep.net/

I think the beauty of this is not the messaging itself, but the abuse of a low level network protocol to jump outside client isolation etc.

Oh, agreed. Just while reading about it, it made me think of Beebeep so thought I'd give it a quick review in case anyone else was reading thinking, "I could use something like that."

I did this with "net send" back in high school and got in trouble.

I don't think "net send" uses ARP as you had to be connected to a domain iirc.

Uses/used NetBIOS in various guises - no ARP.

Haha those were the days. Accidentally (on purpose) sent a message to entire domain in college, IT teachers immediately looked to us trouble makers :D

was just thinking about the same thing but they didn't catch me!

Unless the network analyzer cared about malformed or weird ARP packets (which it probably doesn't) then ARP messaging would probably be undetectable.

`write` sends its regards.

https://en.wikipedia.org/wiki/Write_(Unix)

> I found that trick and showed it to some friends... But it's hard to keep a secret, and somehow a larger non-friend group was using it to cheat in a computer-lab class. I was offended by the blatant cheating, and a little by the idea that certain people I didn't particularly like were profiting from what I'd found.

> So I spoofed the system administrator's username (not hard on Win9x) and sent off a stern warning, which must've surprised them since suddenly all the messages stopped. :)

super neat.

> I also described ARP as a layer 3 protocol. There’s some contention on this — while I think this is the most accurate and easiest explanation, networking is more nuanced than the OSI model might convey. Some would describe ARP as a level 2 or even level 2.5 protocol. For our purposes, I believe calling it level 3 makes the most sense.

TCP/IP doesn't follow the OSI model, so the nuance of OSI isn't directly applicable. ARP is practically defined (ref Stevens) as being in layer 2.5 (of the TCP/IP model), so i believe calling it 2.5 would make the most sense.

and i mean, ARP frames aren't routable. so they clearly aren't L3.

Back when IPv4 NAT was sort of standard (still is but so is IPv6 as well as GCNAT now), I created a thing I called NATChat. It would basically just create a chat room for you based on your public IPv4 address, allowing you to chat with anyone on your network. Was kinda neat to use in office with others (back when that was also a thing).

Other similar in c++: https://github.com/gbonacini/arpchatcpp

That's fun!

That reminds me of a chat software that I did in Delphi 3 back in 1999/2000 (being not that much older than OP) for our LAN parties, that was basically broadcasting on 255.255.255.255 [0]

It was inspired by Kali (remember Kali? [1]) and IRC.

I think it worked until we moved from hubs to switches ;)

Keep on coding! :)

[0] https://i.imgur.com/IPGPaae.png

[1] http://www.tweak3d.net/articles/kali/images/bigchat.jpg

> broadcasting on 255.255.255.255 (...) I think it worked until we moved from hubs to switches ;)

Should work fine on switched network (like DHCP) ? - but won't cross subnets.

Ed: maybe some of you moved to wireless - and some stayed on a different cabled subnet?

You may be right, the details are quite fuzzy ;)

I don't even understand the network code all that much (actually written by a friend) but it does use INADDR_ANY, INADDR_BROADCAST and SO_BROADCAST.

edit: Tried it on two old Windows 7 computers on my mixed rj45 / wifi home network and some chat data are received by the other party and some don't, or it crashes. Fun.

edit2: Actually works great on a version where I could set a specific broadcast address like 192.168.1.255.

This is neat! Might get your interface disabled though in my network. I rate limit ingress ARP on access ports. :)

If you’re limiting yourself to the local network, why use IP at all, when you could use CHAOSNET?

I don't know much about networking...

I've been to ski resorts where there's no phone reception, and I love it that way. No one's on their phones. But it's easy to lose someone for an entire day (or until your agreed meeting time).

Is it possible to use something like this to setup a wireless network which would facilitate chat without a connection to the outside world?

Ok now that I typed it it sounds crazy but I always thought this should be possible

There's a similar app designed for cruises, where you can talk peer-to-peer over the ship's wifi without actually being online. It could work if you have a wifi antenna with you.

Recently my wife and I had separate seats in an airplane and we didn't want to pay for texting. I thought about how I could set up my phone as a hotspot with a captive portal which just presents a chat interface. Nothing came of it, but it was something interesting to think about on a flight, at least.

Aren't iMessages free on most in-flight wifi's today[1]?

Also: I tried this on a United/KLM flight recently, and it didn't work for me.

[1] https://onemileatatime.com/news/united-airlines-free-infligh...

I vaguely remember commercial from 90s. It was Ericsson? phone that could message to another nearby Ericsson phone even without GSM. Or was it Nokia? Google gives my just recent products.

Seems like PTT but I could not manage this thing to work on any Nokias I owned.

It is also possible to configure device IP addresses directly with ARP https://jetdirect.printerdepo.com/en/hp-jetdirect-print-serv...

This isn’t configuring the device IP as such - more just faking an IP address for it temporarily on a single client.

I did something similar to this before in my old job, because installing of chat applications is unauthorized, the solution I come up with is I created a batch script with easily to identify computer network map so regular users will have problem using it, it utilizes net send command.

This is a great and fairly accessible project. I'd like to give this a shot at my local hackerspace!

Now I want to try making a chat system where you just query a dns txt record on a set polling interval

Haha, this is amazing. Going to see if I'll get caught using this later today. :)

Déjà vu I wrote an implementation that _exactly_ did this PoC a decade ago.

Modern network protocols have so much extra reserved bits that you can add pretty much anything want in it; keep going ;)

Ah, good old days of NetBEUI are finally returning!

Reply on news.ycombinator.com