Unit 3: Local networks · Lesson 3 of 7 · 20 min
The gateway and ARP spoofing
Learn why the gateway matters and spot a machine claiming to be it.
mission
- You are
- The analyst on call.
- Situation
- Two laptops report certificate warnings on websites they use every day. A capture from the office segment has been saved as
arp.pcap. - Goal
- Prove whether a machine on the segment is impersonating the gateway, and identify it.
- Hand in
- The impostor's MAC, the IP it uses for itself and how many forged replies it sent.
A spoofed reply
Press play or step through.
Let tshark raise the flag
Wireshark's expert system notices when two MACs claim one IP. Ask for its warnings first.
tshark -r arp.pcap -q -z expert,warn
Warns (20)
=============
Frequency Group Protocol Summary
20 Sequence ARP/RARP Duplicate IP address configured (10.10.0.1)
you should see Twenty warnings about 10.10.0.1.
Rank who claims what
Count every IP and MAC pair that answered. A real router answers when asked; a spoofer answers all the time.
tshark -r arp.pcap -Y 'arp.opcode==2' -T fields -e arp.src.proto_ipv4 -e arp.src.hw_mac | sort | uniq -c | sort -rn
20 10.10.0.1 02:42:0a:0a:00:42
3 10.10.0.1 02:42:0a:0a:00:01
1 10.10.0.31 02:42:0a:0a:00:1f
1 10.10.0.23 02:42:0a:0a:00:17
you should see One IP, two MACs. The genuine gateway answered the three questions it was asked; the other MAC answered twenty times nobody asked.
Measure the rhythm
frame.time_delta_displayed is the gap since the previous displayed packet. Steady gaps mean a tool, not a person.
tshark -r arp.pcap -Y 'arp.opcode==2 && arp.src.hw_mac==02:42:0a:0a:00:42' -T fields -e frame.time_delta_displayed | head -n 5
0.000000000
0.900090000
1.032564000
0.994051000
1.051946000
you should see About one forged reply per second.
defender tip When you write this up, give the evidence that anyone can rerun: the filter, the count and the time range.
Defending the segment
any port may send ARP replies for any IP address
One laptop can redirect everyone's traffic.
replies checked against DHCP leases per port forged replies dropped
The switch refuses the lie at the port.
Look up the impostor
Match the spoofing MAC against DHCP leases.
grep 02:42:0a:0a:00:42 inventory/dhcp-leases.txt
1760437100 02:42:0a:0a:00:42 10.10.0.66 * 01:02:42:0a:0a:00:42
you should see It took 10.10.0.66 and gave no host name: an unknown device, not a company laptop.
defender tip Turn on DHCP snooping and dynamic ARP inspection on access switches so forged ARP replies are dropped at the port.
What a defender takes away
- 1Whoever owns the gateway's MAC in a cache sees that machine's internet traffic.
- 2One IP with two MACs, one of them chatty, is the signature of ARP spoofing.
- 3The fix lives on the switch: inspection per port, then find and unplug the device.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.