1

On my school network, using wireshark to see network traffic (filter=arp), I only see gratuitous packets. Meaning, all hosts on network send gratuitous packets (ex: gratuitous for 10.10.3.54, gratuitous for 10.10.3.59, etc). I believe this technic is used to counter mitm attacks. Is it really? why?, if it is still vulnerable to mitm attack, why? How could you prevent it then?. Note, when I say mitm attack, I usually reffer to arp poisonning.

++++++++++

Using nmap and scanning the subnet 10.10.3.0, there is no results (I only see my ip). I tried no ping, quick scan, intensive scan). Yes, my command started with 10.10.3.0/24.

  • What are your nmap switches? Did you use -Pn to determine if ICMP is disabled on the target(s)? – Jeroen Oct 3 '15 at 3:23
  • Tried it, without result – Bob Ebert Oct 3 '15 at 3:36
1

I do not think that the gratuitous have something to do with MITM attack prevention. Hosts usually send gratuitous ARP packets when they join the network to notify other host about their presence and their IP/arp info (even if they have not received an ARP request). Host send such packets also in case their interface comes up and in some other cases.

Some switches have a built in protection against ARP poisoning attacks. CISCO calls this technique "Dynamic ARP Inspection". In short, before forwarding an ARP packet, it verifies if the advertised IP address was really issued by the DHCP server to a host with the particular ARP address.

If you want to sniff all packets on a network segment, you will have to have an network/wifi adapter that supports promiscuous mode (and that mode should be enabled). On a wired network, the network switch will of course not forward all traffic to you, but only traffic that is sent to your MAC address. Because of that, it would be a good idea ARP poison the network and force the switch to forward more traffic to you than it should.

Regarding your last note, I would suggest you to try an ARP scan with nmap:

nmap –PR target
  • But, only gratuitous is used on that network (no is_at/who_has). That doesn't mean anything? – Bob Ebert Oct 3 '15 at 15:31
0

In a brief, gratuitous packets are sent by a PC to update other PC's caches.
It is used by an attacker in mitm attack to poison the arp cache, and it also can be used to stop that attack by using some kind of switches which is able to sniff the network for gratuitous arp packets and re-send the correct data through the network.

  • Thank you for your answer, but that doesn't really answer it. Can you be more specific, provide examples or try to answer it in a different way? – Bob Ebert Oct 3 '15 at 0:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.