3

Statement (In Interview):

ARP spoofing attacks are more effective for UDP packets rather than TCP packets since TCP establishes reliable communication channels.

I have opposed the statement saying that once ARP spoofing is done, then we are connected to the victim with a reliable TCP connection as the connection is based on IP addresses.

Which one is True?

1
  • 1
    ARP uses MAC addresses and Ethernet frames, not UDP/TCP packets.
    – schroeder
    Feb 20, 2022 at 18:57

1 Answer 1

4

The reliability of both is equally impacted (or not impacted) by ARP spoofing, so yes, you should object, but your reasoning doesn't make sense. Both TCP and UDP are layered on top of IP, and have no visibility of the level at which ARP spoofing happens (Ethernet).

If there's no contention from the other hosts, ARP spoofing is fully reliable for all IP-based protocols. You do it once, the gateway thinks that you're the victim and the victim thinks that you're the gateway, and you have a reliable MitM position over which you can send TCP, UDP, ICMP, or anything else IP-based.

If there's contention from the other hosts and they try to re-assert the actual network topology, it doesn't matter what you're using on top of IP. Every so often, the mapping of IP to Ethernet (MAC) address will get changed, and you (the attacker) will be out of the loop. If a packet arrives / is sent during this time, it will bypass you.

The one place this might matter is if you're implementing a transparent proxy, terminating the TCP connection from the client (pretending to be the server) and starting a new one to the server. In that case, the sequence numbers on each side of you will be different, and without you in the loop, the connection will break. However, there's no need to do this; you can just modify the TCP stream bidirectionally without actually terminating it.

Of course, if you're doing something like SSL Stripping (where one side will be using TLS and the other won't), that will still break. That has nothing to do with using TCP or UDP, though. If you're "stripping" DTLS (which is UDP-based), then as soon as you're cut out you'd once again have the two sides of the conversation speaking different protocols at each other and things would break.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .