I have a basic lab with one Win7 VM in a LAN and another (vyos) serving as the default gateway.

When I start my Kali Linux VM (it is attached to the same LAN segment) I can see ping requests and replies in Wireshark between the Win7 VM and the router (vyos). I don't understand how this is possible. I haven't started any ARP spoofing attack yet, and on the Kali box when I look at the trace I can see that the L2 and L3 addressing is matching the LAN Host's and routers addressing, so what is going on?

EDIT: Also, the NIC of the Kali VM is set to promiscuous mode but this got me thinking that in a physical Ethernet environment we would not see the packets anyway, we would have to configure SPAN / mirroring on the switch to first mirror the packets to the port on which we are listening in promiscuous mode.

enter image description here

So the question is, are virtual environments good enough for this type of task? Or should I stick to a physical switch? For now they seem to be rather confusing.

EDIT Here's the topology: enter image description here

So here's what I do next: a) create a static arp entry on Win 7 to map the default gateway's IP to it's MAC b) on Kali Linux on it's corresponding NIC - disabled promiscuous mode c) started ettercap and discovered all hosts (it discovers the Win7 and vyos VM) d) select the targets respectively e) start ARP spoofing attack - i can see on the Windows 7 box a fake ARP replay toward the Win7 VM f) also XARP on the Win7 box reports something "unusual":

enter image description here

g) I then check the arp table on the Windows 7 box and it looks ok, I mean the static entry was not overwritten and the dynamic entry is fine too, because it maps the Kali's IP to it's MAC

enter image description here

h) but when I start Wireshark on the Kali VM I can see the ICMP packets, but WHY? OK, I just figured it out. In fact I can see only the Echo Replay's from the gateway to the Windows7 because the arp table on the router (vyos) does not contain any static mappings, hence it's directs all traffic through the Kali VM, but the traffic from the Win7 VM is going directly to the router.

  • LAN VM is a Windows 7 box and it's default gateway is pointing to the vyos interface that is in the same LAN segment. The Kali VM is attached to the same network. – cyzczy Mar 13 '17 at 14:41
  • I don't understand what the security question is. I also don't understand what "task" you are talking about. Most testers run Kali in a VM alongside other VMs. – schroeder Mar 13 '17 at 14:41
  • Your NIC in promiscuous mode is seeing packets from other machines. I'm not sure what the problem is. You wanted to have to configure mirroring on the virtual switch? – schroeder Mar 13 '17 at 14:44
  • @adam86 I've had a similar setup only with pfSense as the gateway, and no matter what I tried, I couldn't see packets that weren't addressed to/from the kali machine. This leads me to believe that the router OS is the culprit. I think this setup is good for learning anyway, as long as you know what is similar to physical networks and what is different. This promiscuous mode thing for example. – MiaoHatola Mar 13 '17 at 14:48
  • @schroeder sorry that it's not cleat enough. The point I'm trying to make is that in virtual environment like this it's enough to change the NIC settings to promiscuous mode and you will see all packets wheres in a physical environment where you connect to a physical switch even with your card set to promiscuous mode it's not enough because of how switches work, so you would have to either configure SPAN or make the traffic to go to the attackers device. – cyzczy Mar 13 '17 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.