If my session is under a Man-In-The-Middle attack, can I detect it by checking the ip addresses my machine is connected to? For example, I want to know if my connection to a certain website is MITMed or not, I can visit the site and then use netstat -antp to find out the IP to which I am connected.

If I am MITMed, that IP will belong to the attacker, and be different from the actual website. Does that work in detecting an attack?

3 Answers 3


If the MITM attack was done using arp poisoning (for example in public WiFi network), then you will not see the attackers IP anywhere.

Lets say the default gateway of a WiFi network is The attacker can send arp responses to your machine telling it that he is Your machine will continue to send packets to the address, but the system will resolve it to the MAC of the attacker, and not to the MAC of the real gateway.

All the IP addresses of all websites you visit will remain unchanged from your machines point of view. Only the MAC entry of your default gateway in your arp table will have changed.

  • Well, even more fundamentally, you don't need ARP poisoning; if the attacker is on the route between you and the server, it's completely transparent. Which is why an ISP can decide to be a dick and send a TCP RST without needing to be in your LAN. Incidentally, ISPs have been known to do that. Jul 16, 2015 at 1:23
  • @ParthianShot I'm not sure about the "transparent" part. Your ISP is loudly part of the route.
    – schroeder
    Jul 16, 2015 at 2:34

If you are running Arpwatch with alerting on you can write a script to stop all traffic when it detects an MAC address change. This will protect you from IP spoofing, and force your attention to the problem. This assums they are not MAC spoofing as well.

But this only works for active MITM attacks, this will not work for passive MITM, for that you need to use layered encryption with forward secrecy.

  • 1
    I'm not sure this will protect you from IP spoof, but it does protect against MAC spoofing. This will also only work on the local network.
    – schroeder
    Jul 16, 2015 at 2:37
  • Goodguy IP: MAC:AA:BA:CA:DA:EE:FE, Badguy IP: MAC:AA:BA:CA:DA:EE:AA, I hope you see the difference now
    – Citizen
    Jul 16, 2015 at 13:30
  • That's not IP Spoofing, that's just a duplicate IP on the network.
    – schroeder
    Jul 16, 2015 at 14:52
  • That is also how you carry out an Arp attack, by tricking the victim into thinking your the other guy. After you do that you can then MITM at will. For your reading @schroeder, windowsecurity.com/articles-tutorials/…
    – Citizen
    Jul 16, 2015 at 16:24
  • And this one, en.wikipedia.org/wiki/ARP_spoofing , Arp spoofing is how IP spoofing is accomplished.
    – Citizen
    Jul 16, 2015 at 16:31

Yes, but not in all cases. this depends on your network and routing setup.

If you are behind a proxy firewall, then you will probably only see the IP address of the proxy all the time, as all of your web requests will be routed through it.

Also, if the webserver(i assume) is behind a Public IP/gateway and that MITM is also behind that same public IP/gateway, then you cannot detect it.

If an attacker is smart enough to MITM, i assume she is smart enough to spoof the IP addresses too.

  • Did you mean "spoof DNS" or "spoof IP"?
    – schroeder
    Jul 16, 2015 at 2:35
  • the attacker can spoof her IP address so that the victim(client) will see the public IP address of the webserver as the destination address.
    – JOW
    Jul 16, 2015 at 11:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .