3

In Kali you can:

airmon-ng start wlan0
ifconfig mon0 down
macchanger -r mon0       (-r changes mac id to a random number)
ifconfig mon0 up

This attack for example: aireplay-ng -0 2 -a [ap mac #] -c [client mac #] mon0

While using snort it detects the attack but with the spoofed mac.

In wireshark focused on mon0 you can see the source and see its a --deauth packet to client mac but how can it detect a spoofed mac and see the real one?

1
  • Some firewalls (pf for instance) offer an OS fingerprinting feature, I was always wondering how such a feature would be efficient to detect, for instance, when MAC we now to be associated to a Windows machine is currently used by a Linux one... Jan 23, 2015 at 16:47

1 Answer 1

4

In some cases, you may be able to detect if a MAC address has been spoofed (see below), but it is not possible to detect the original value only by analyzing traffic captures. That is because the network card simply sends another value than the one which it is programmed to send. The original value will never be found in the packet content, if another value is in use.

By analyzing a MAC address, you can check if the OUI corresponds to the ones used in your organization or if it doesn't correspond to any known OUI (e.g. 12:34:56:67:89:10). Of course, it is trivial to set a valid MAC address, thus making detection impossible. http://en.wikipedia.org/wiki/MAC_addressaa

Image source: Wikipedia

2
  • Very interesting, still learning of course though. Thank you for the information, I will be sure to research more of this soon. :)
    – user66895
    Jan 23, 2015 at 12:17
  • I think it would be incredibly difficult to identify if the OUI is used in your organization. These identifiers come from the NIC manufacturer, or the computer manufacturer. Manufacturers of user devices are going to vary tremendously even within a small company. You might be able to identify OUIs that haven't been purchased and registered with the IEEE, but that's the best you could reasonable do unless you keep a global list of all MAC addresses, which is difficult if not impossible. Jan 23, 2015 at 20:35

You must log in to answer this question.