If my session is under a Man-In-The-Middle attack, can I detect it by checking the ip addresses my machine is connected to? For example, I want to know if my connection to a certain website is MITMed or not, I can visit the site and then use netstat -antp to find out the IP to which I am connected.
If I am MITMed, that IP will belong to the attacker, and be different from the actual website. Does that work in detecting an attack?
If the MITM attack was done using arp poisoning (for example in public WiFi network), then you will not see the attackers IP anywhere.
Lets say the default gateway of a WiFi network is 192.168.1.1. The attacker can send arp responses to your machine telling it that he is 192.168.1.1. Your machine will continue to send packets to the address 192.168.1.1, but the system will resolve it to the MAC of the attacker, and not to the MAC of the real gateway.
All the IP addresses of all websites you visit will remain unchanged from your machines point of view. Only the MAC entry of your default gateway in your arp table will have changed.
If you are running Arpwatch with alerting on you can write a script to stop all traffic when it detects an MAC address change. This will protect you from IP spoofing, and force your attention to the problem. This assums they are not MAC spoofing as well.
But this only works for active MITM attacks, this will not work for passive MITM, for that you need to use layered encryption with forward secrecy.
Yes, but not in all cases. this depends on your network and routing setup.
If you are behind a proxy firewall, then you will probably only see the IP address of the proxy all the time, as all of your web requests will be routed through it.
Also, if the webserver(i assume) is behind a Public IP/gateway and that MITM is also behind that same public IP/gateway, then you cannot detect it.
If an attacker is smart enough to MITM, i assume she is smart enough to spoof the IP addresses too.
