1

On my school network, using wireshark to see network traffic (filter=arp), I only see gratuitous packets. Meaning, all hosts on network send gratuitous packets (ex: gratuitous for 10.10.3.54, gratuitous for 10.10.3.59, etc). I believe this technic is used to counter mitm attacks. Is it really? why?, if it is still vulnerable to mitm attack, why? How could you prevent it then?. Note, when I say mitm attack, I usually reffer to arp poisonning.

++++++++++

Using nmap and scanning the subnet 10.10.3.0, there is no results (I only see my ip). I tried no ping, quick scan, intensive scan). Yes, my command started with 10.10.3.0/24.

Improve this question
2
  • What are your nmap switches? Did you use -Pn to determine if ICMP is disabled on the target(s)?
    – Jeroen
    Oct 3, 2015 at 3:23
  • Tried it, without result
    – Bob Ebert
    Oct 3, 2015 at 3:36

2 Answers 2

Reset to default
1

I do not think that the gratuitous have something to do with MITM attack prevention. Hosts usually send gratuitous ARP packets when they join the network to notify other host about their presence and their IP/arp info (even if they have not received an ARP request). Host send such packets also in case their interface comes up and in some other cases.

Some switches have a built in protection against ARP poisoning attacks. CISCO calls this technique "Dynamic ARP Inspection". In short, before forwarding an ARP packet, it verifies if the advertised IP address was really issued by the DHCP server to a host with the particular ARP address.

If you want to sniff all packets on a network segment, you will have to have an network/wifi adapter that supports promiscuous mode (and that mode should be enabled). On a wired network, the network switch will of course not forward all traffic to you, but only traffic that is sent to your MAC address. Because of that, it would be a good idea ARP poison the network and force the switch to forward more traffic to you than it should.

Regarding your last note, I would suggest you to try an ARP scan with nmap:

nmap –PR target
Improve this answer
1
  • But, only gratuitous is used on that network (no is_at/who_has). That doesn't mean anything?
    – Bob Ebert
    Oct 3, 2015 at 15:31
0

In a brief, gratuitous packets are sent by a PC to update other PC's caches.
It is used by an attacker in mitm attack to poison the arp cache, and it also can be used to stop that attack by using some kind of switches which is able to sniff the network for gratuitous arp packets and re-send the correct data through the network.

Improve this answer
1
  • Thank you for your answer, but that doesn't really answer it. Can you be more specific, provide examples or try to answer it in a different way?
    – Bob Ebert
    Oct 3, 2015 at 0:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .