Questions tagged [arp]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
49 views

Detecting and preventing ARP spoof/sniff/poison mixed with MAC spoof with an ISP router

To protect me from ARP spoofing, I tried most of the programs spread here and there and read most of the scientific papers on this subject, but I found a lot of ignorance and evasiveness to hide a ...
user avatar
4 votes
3 answers
1k views

An ARP table keeps multiple MAC addresses for an IP address or a single one?

Some ARP spoofing texts say that this man-in-the-middle attack overwrites the intended target MAC with the attacker's MAC in the ARP table (e.g. https://en.wikipedia.org/wiki/ARP_spoofing , Question ...
user avatar
0 votes
0 answers
72 views

ARP Spoofing: Replying to requests meant for spoofed IP, while also being able to communicate with spoofed IP

I am simulating an ARP Spoofing attack on a local network. I have an Attacker machine on Linux, a web server, and a Victim machine which is trying to access the web server. I am successfully able to ...
user avatar
  • 1
0 votes
1 answer
105 views

Question regarding arp spoofing

There is something I do not understand about arp spoofing, and no article I read so far seems to explain it: Assume the following setting: We have three hosts A,B,C with ip addresses 192.168.178.{10,...
user avatar
  • 101
1 vote
2 answers
216 views

Need help understand ARP spoofing attack?

I am currently reading the network exploitation section of the book Hacking: The art of exploitation. The book covers ARP spoofing attack in brief, but doesn't go over much detail. Before starting I ...
user avatar
  • 13
1 vote
1 answer
114 views

Blocking network scanning attempts at the switchport [closed]

Have noticed that I can scan the network though I have set an arp limit rate on the Cisco switch switchport and need some recommendations. The previous engineer set an arp rate limit of 200 and ...
user avatar
  • 151
1 vote
1 answer
229 views

MITM attack using ICMP packet injection

I came across an infosec presentation from a conference which discussed how ICMP packets can be used to compromise a connection between two machines. More specifically, they described the process as: ...
user avatar
  • 659
2 votes
1 answer
750 views

ARP Spoofing does not update ARP Table

I'm currently trying to do ARP-Spoofing / ARP-Poisoning with Kali Linux in Virtualbox in order to check the security of the Network of my company. I'm currently doing a little pentest, therefore I am ...
user avatar
0 votes
1 answer
189 views

Arp poisoning is disrupting the LAN

I'm poisoning my home network, I was able to do it 1 time. When i tried several more times to poison the wifi network or the cable network the "target" started to lose connectivity in both cases. ...
user avatar
  • 11
3 votes
3 answers
2k views

Is there any point of arp spoofing on a wifi network?

I know that arp spoofing is required on a LAN network due to the fact that data is sent directly to a destination, but what about for a WLAN network? All packets can be seen if you are in promiscuous ...
user avatar
0 votes
1 answer
1k views

Why does arp spoofing on a local network 'break' internet access for the victim?

I'm doing some experimenting with Kali on my home network and was wondering about something regarding ARP spoofing. When I ARP spoof another device AND the default gateway, Internet access stops ...
user avatar
  • 101
1 vote
0 answers
353 views

NMAP not showing all live hosts [closed]

I have a live host on 192.168.0.151 on my local network. I know it's live since I've set it up with a static IP and also if pinged, I get a reply. The weird thing is when I run nmap -sP 192.168.0....
user avatar
0 votes
2 answers
222 views

Why isn't there a defense system against ARP poisoning?

Wireshark can detect these kind of activites, and warn us by a 'duplicated ip address' message. Why doesn't the router act like this? The other way is to check the cache, and don't allow two different ...
user avatar
4 votes
2 answers
6k views

Why can't iptables drop arp requests

I was trying to hide my laptop from my phone's network scan app. The app is using arp requests to find devices on the network. I tried everything on iptables. It doesn't work, even if i set all the ...
user avatar
  • 353
1 vote
1 answer
332 views

ARP poisoning NAC

I need some help in understanding the technique of Genians/Trustwave NAC regarding ARP poisoning. As seen here Bypassing Trustwave NAC, it looks like a good method, but I don't simply get it. With ARP ...
user avatar
  • 76
2 votes
1 answer
1k views

ARP request replay attack - why do APs work the way they do?

ARP request replay attacks are based on the practice that wireless access points repeat ARP packets injected into the network, and since these ARP packets are encrypted, they also carry the IV with it....
user avatar
3 votes
1 answer
550 views

How ARP spoofing works when the attacker has a different IP address than target?

I am unable to understand fully how ARP spoofing attacks are successful. Assuming three PCs are connected to a single switch PC-1 - IP address 192.168.1.1, MAC: AA:AA:AA:AA:AA:AA PC-2 - IP address ...
user avatar
0 votes
0 answers
654 views

What are all of these IPs addresses? Honeypots?

I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
user avatar
1 vote
0 answers
346 views

ARP poisoning command slows down victim internet and victim has no access

im currently enrolled in a CPEH course my 3rd lab was arp poison. command i used is echo -1 > /proc/sys/met/ipv4/ip_forward iptables -t nat -A PREROUTING -p tcp --detination-port 80 -j REDIRECT -...
user avatar
2 votes
2 answers
487 views

Does ARP spoofing works in case the target ARP cache has the gateway

I am trying to create a script that will do a basic ARP spoofing attack (I choose this StackExchange website because the question is more about the theoretical side), and I see no reference to the ...
user avatar
  • 23
1 vote
2 answers
1k views

Ettercap man in the middle - ARP poison

I am experimenting a bit with Ettercap in my local Wifi Lan. I have a router (R), my pc (P) with Ettercap running on it and my smarthphone (S). In particular am testing the ARP poison MIM attack and ...
user avatar
  • 130
4 votes
1 answer
5k views

Problem with ARP-Spoofing

first of all i have a basic questions regarding network traffic: All Devices in the network are connected with WLAN and a Router. If i send a message from my computer to a other device in the network ...
user avatar
  • 41
3 votes
3 answers
524 views

ARP request spoofing

I'm working on an SDN-based access/backhaul network. For some experiments I need to generate an ARP request from one of the node in my network, pretending to be another one. Essentially this ARP ...
user avatar
  • 31
3 votes
2 answers
5k views

Best practice to discover network hosts?

I'm creating a python networking program and need to discover all the usable hosts on the network such as phones and desktops on Linux. What works better, NMAP, Arp-Scan, arp, or something else? I've ...
user avatar
1 vote
1 answer
783 views

Can't see ARP poisoning packets on Wireshark and Scapy

I'm trying to create a python script to detect ARP poisoning on WiFi networks. I'm using scapy and wireshark to check scapy's output. I'm stuck trying to see all ARP traffic on the network, I can only ...
user avatar
0 votes
1 answer
193 views

Why arp returns initial state after arpspoof stopped?

I'm wondering why ARP table in my laptop returns to its initial state when arpspoof tool attack is stoppped. Is there any option for the attacker to modify the victims ARP table until the default ...
user avatar
3 votes
2 answers
4k views

What is the role of ARP poisoning when doing a DHCP spoofing attack

My Current Background on the topic DHCP Spoofing is done by a rogue DHCP server on the network which replies to DHCP requests from hosts(Attacker can run a DHCP starvation attack on the legitimate ...
user avatar
  • 133
1 vote
1 answer
2k views

Is it possible to Spoof Another Machine's MAC Address on LAN?

Is it possible to Spoof Another Machine's MAC Address on LAN? I know we can spoof mac address of machine that we are currently on, using macchanger or ifconfig wlan0 ether de:ad:be:ef:ca:fe. But I ...
user avatar
  • 111
0 votes
1 answer
384 views

How to test DoS attack by sending unsolicited ARP packets over ethernet?

I want to test a system for DoS attack using ARP packets as the system only responds to ARP packets and left all ports are closed. Can nmap or arping help in this case?
user avatar
  • 101
3 votes
3 answers
4k views

Force a device to give up its IP address?

Expanding to a previous question where I asked if it would be possible to redirect traffic on a port from another device to my local device, if a PC on my network (device A) has the IP address 192.168....
user avatar
2 votes
0 answers
276 views

How is ARP-spoofing of a Modular CMTS online connection via coaxial broadband even possible?

as one can see on the following screen photos / screenshots, I'm permanently getting ARP-spoofed: My router's MAC adress should be "90:5C:44:E2:8D:24", as can be seen on the screenshot of my router's ...
user avatar
1 vote
0 answers
1k views

Why computer answers an Arp Request made by Itself

I am studying about arp, and I want to know more about how it works. Right now, I am using Wireshark and this function that returns the mac address from a given ip address ipAddress: ...
user avatar
  • 111
2 votes
0 answers
357 views

Arp Spoofing detection with Ruby [closed]

I am planning to develop a Ruby script that detects ARP spoofing attacks on a local network, I have a few questions about it. There are three scenarios I am taking into consideration: First idea as ...
user avatar
2 votes
1 answer
500 views

ARP poisoning attack consequences

For testing purposes, I want to apply promiscuous mode in Wireshark to capture traffic not sent to me. For this, I believe there is the need to poison the ARP table in the switch so that the attacker ...
user avatar
  • 779