0

I am going through the slides at:

https://www.slideshare.net/slideshow/packet-sniffing-85873158/85873158

i.e. we have 3 machines:

A’s ARP cache shows:

  • B’s IP address is associated with Z’s MAC address
  • Z’s IP address is associated with Z’s MAC address

B’s ARP cache shows:

  • A’s IP address is associated with Z’s MAC address
  • Z’s IP address is associated with Z’s MAC address

Z’s ARP cache shows:

  • A’s IP address is associated with Z’s MAC address
  • B’s IP address is associated with Z’s MAC address

The slide 15 says that attacker Z has access to all of A’s and B’s message.

But the following article at: An ARP table keeps multiple MAC addresses for an IP address or a single one?

Its says that the above situation i.e. 2 IP addresses mapped to a single MAC address is not an evidence of ARP spoofing.

However, it says that: 2 MAC addresses mapped for same IP is an evidence of ARP spoofing.

This looks contrary. If B’s IP address is mapped to Z’s MAC address after the attack, then B’s IP address is mapped to B’s own MAC address before the attack. Hence slideshare’s example also okays the argument I.e. 2 MAC addresses mapped for same IP is an evidence of ARP spoofing.

Please guide me if the example provided in the slide an evidence of ARP spoofing?

Improve this question
2
  • 1
    What is contradictory? Where does the article say "2 IP addresses mapped to a single MAC address is not an evidence of ARP spoofing." You use "it" without explaining what you are referencing.
    – schroeder ♦
    Commented Jul 10 at 17:07
  • I'm sorry. I used "it" for the Stack Exchange article. I showed the link. But you are right; using pronouns is discouraged in technical writing. Zulfi.
    – user2994783
    Commented Jul 10 at 18:29

1 Answer 1

Reset to default
5

It is very common to have multiple IP addresses at the same MAC. Even on simple systems there are usually a single IPv4 address and then multiple IPv6 addresses (with different scopes) on the same MAC. And there are many other scenarios where multiple IP on same MAC are common. And it is not a problem: any IP packet has a clear physical presence, so it is clear where packets should be sent to at the lunk layer.

But same IP on different MAC would mean instead that it is not clear to which physical interface/system a specific IP packet should be sent too.

Improve this answer
3
  • Slide shows Computer B associated with Z's MAC address but before the attack, B's IP address is associated with its own MAC address. So same IP on different MAC. Same is true for Computer A.
    – user2994783
    Commented Jul 10 at 18:34
  • @user2994783 One ARP table (one machine) can't map an IPaddr to multiple MACs -- it has only one entry per IPaddr; if subsequently that machine gets info -- true or false -- about a different MAC for that IPaddr, the newly-seen MAC replaces the prior one. That change could be the result of the address legimately moving -- for example a NIC fails and is replaced -- but that's fairly rare and it likely indicates spoofing.
    – dave_thompson_085
    Commented Jul 11 at 0:28
  • @dave_thompson_085: less rare are "floating" IP addresses in high-availability scenarios, which get moved to another system if the system currently "owning" the IP has problems. This is usually combined with Gratuitous ARP to speed up propagation of the new mapping in the network - which might look like an ARP spoofing attack.
    – Steffen Ullrich
    Commented Jul 11 at 4:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .