----- Forwarded message from Hisham Mardam Bey -----
Date: Sun, 21 Mar 2004 13:52:59 +0200
In short, I need to detect when someone on the network uses my MAC and
my IP address.
Longer story follows. I am on a LAN which might have some potentially
dangerous users. Those users might spoof my MAC address and additionally
use my IP address, thus forcing my box to go offline, and not be able to
communicate with my gateway. What I need is a passive way to check for
something of the sort, and perhaps a notofication into syslog (the
latter is not very important).
Il dom, 2004-03-21 alle 06:09, Jad Saklawi ha scritto:
> ----- Forwarded message from Hisham Mardam Bey -----
> Date: Sun, 21 Mar 2004 13:52:59 +0200
>
> In short, I need to detect when someone on the network uses my MAC and
> my IP address.
>
> Longer story follows. I am on a LAN which might have some potentially
> dangerous users. Those users might spoof my MAC address and additionally
> use my IP address, thus forcing my box to go offline, and not be able to
> communicate with my gateway. What I need is a passive way to check for
> something of the sort, and perhaps a notofication into syslog (the
> latter is not very important).
maybe using ettercap would ease the task of finding spoofers
Cheers,
Filippo Carone
Jad Saklawi wrote:
> ----- Forwarded message from Hisham Mardam Bey -----
> Date: Sun, 21 Mar 2004 13:52:59 +0200
>
> In short, I need to detect when someone on the network uses my MAC and
> my IP address.
>
> Longer story follows. I am on a LAN which might have some potentially
> dangerous users. Those users might spoof my MAC address and additionally
> use my IP address, thus forcing my box to go offline, and not be able to
> communicate with my gateway. What I need is a passive way to check for
> something of the sort, and perhaps a notofication into syslog (the
> latter is not very important).
Use arpwatch, it detects ALL changes of IP<=>MAC mapping.
--
bill davidsen <[email protected]>
CTO TMR Associates, Inc
Doing interesting things with small computers since 1979
Hi,
On Sun, Mar 28, 2004 at 10:58:16PM -0500, Bill Davidsen wrote:
> Jad Saklawi wrote:
> >----- Forwarded message from Hisham Mardam Bey -----
> > Date: Sun, 21 Mar 2004 13:52:59 +0200
> >
> >In short, I need to detect when someone on the network uses my MAC and
> >my IP address.
> >
> >Longer story follows. I am on a LAN which might have some potentially
> >dangerous users. Those users might spoof my MAC address and additionally
> >use my IP address, thus forcing my box to go offline, and not be able to
> >communicate with my gateway. What I need is a passive way to check for
> >something of the sort, and perhaps a notofication into syslog (the
> >latter is not very important).
>
> Use arpwatch, it detects ALL changes of IP<=>MAC mapping.
It won't tell him when someone else uses both IP and MAC. The real solution
is to lock the MAC on the switch if possible. Another one is to use a second
host to launch regular ARP requests and count how many replies it gets. Note
that it is also possible to do this from his host, but he will need arping
and tcpdump in promiscuous mode, because the reply address will have to be
a fake one (MAC and IP) so that the switch forwards the reply on all ports.
Completely passive solution will not always detect the event. The attacker
might send packets to another host or even to the switch itself, which will
not propagate to other ports (eg: ethernet loopback with SA=DA= his MAC).
But if they make a mistake, then listening to all incoming packets and logging
their source MAC when it's the same as his host might work. This can be
implemented very easily with arptables but just for ARP requests. ebtables
might be better suited, but needs to configure a bridge which is dangerous.
Hmmm this reminds me good memories... :-)
Willy
Willy Tarreau wrote:
> Hi,
>
> On Sun, Mar 28, 2004 at 10:58:16PM -0500, Bill Davidsen wrote:
>
>>Jad Saklawi wrote:
>>
>>>----- Forwarded message from Hisham Mardam Bey -----
>>> Date: Sun, 21 Mar 2004 13:52:59 +0200
>>>
>>>In short, I need to detect when someone on the network uses my MAC and
>>>my IP address.
>>>
>>>Longer story follows. I am on a LAN which might have some potentially
>>>dangerous users. Those users might spoof my MAC address and additionally
>>>use my IP address, thus forcing my box to go offline, and not be able to
>>>communicate with my gateway. What I need is a passive way to check for
>>>something of the sort, and perhaps a notofication into syslog (the
>>>latter is not very important).
>>
>>Use arpwatch, it detects ALL changes of IP<=>MAC mapping.
>
>
> It won't tell him when someone else uses both IP and MAC. The real solution
> is to lock the MAC on the switch if possible. Another one is to use a second
> host to launch regular ARP requests and count how many replies it gets. Note
> that it is also possible to do this from his host, but he will need arping
> and tcpdump in promiscuous mode, because the reply address will have to be
> a fake one (MAC and IP) so that the switch forwards the reply on all ports.
If he sees the packet it should alert on the local MAC or IP on an
external packet. As noted you won't get the external packet in all cases.
>
> Completely passive solution will not always detect the event. The attacker
> might send packets to another host or even to the switch itself, which will
> not propagate to other ports (eg: ethernet loopback with SA=DA= his MAC).
> But if they make a mistake, then listening to all incoming packets and logging
> their source MAC when it's the same as his host might work. This can be
> implemented very easily with arptables but just for ARP requests. ebtables
> might be better suited, but needs to configure a bridge which is dangerous.
I like the idea of sending ARP after changing the MAC. I would hope to
have an option in the switch which prevents MAC takeover by locking the
MAC to a port as long as the link is up. This doesn't prevent sending a
packet to another host with the real (evil) MAC and spoofed IP, to set
the arptable in a single host. In the long run help from the switch is
probably needed to do it right.
--
-bill davidsen ([email protected])
"The secret to procrastination is to put things off until the
last possible moment - but no longer" -me