Yeh APR - Arp Poison Routing, used for Hijacking Traffic between two hosts.
Not exactly sure how the packets look but the basics of it are, that your
p.c responds to arp packets from for instance a host, and its gateway,
telling both of them that it's the host its looking for, the traffic is then
routed through your p.c as the host thinks you're the gateway, and the
gateway thinks you're the host.
Incidentally, depending on what your using, your p.c should then act as a
router, and route the traffic to the host and the gateway, with this
occurring all the traffic is passing through your box, and you can sniff the
traffic.
Ta
Paul
-----Original Message-----
From: Eygene A. Ryabinkin [mailto:rea@rea.mbslab.kiae.ru]
Sent: 15 December 2005 15:06
To: incidents@securityfocus.com
Subject: A bit strange ARP queries
Good day!
Has anyone seen such ARP packets? I am a bit curious, because we have no
strange hardware that will set the target hardware address in the who-has
ARP packet. Are there any attacks that using such packets?
-----
15:29:59.908901 arp who-has the-host-in-question (4:c0:40:1:e0:df) tell
the-requester
15:30:00.911228 arp who-has the-host-in-question (57:43:50:10:40:0) tell
the-requester
15:30:01.912045 arp who-has the-host-in-question (2e:2f:30:31:32:33) tell
the-requester
15:30:02.913314 arp who-has the-host-in-question (2e:2f:30:31:32:33) tell
the-requester
15:30:03.915013 arp who-has the-host-in-question (2e:2f:30:31:32:33) tell
the-requester
15:30:04.915854 arp who-has the-host-in-question (2e:2f:30:31:32:33) tell
the-requester
15:30:25.962925 arp who-has the-host-in-question (2e:2f:30:31:32:33) tell
the-requester
15:30:26.966171 arp who-has the-host-in-question (2e:2f:30:31:32:33) tell
the-requester
15:30:26.991402 arp reply the-host-in-question is-at 0:d:88:e6:db:dc
15:31:01.025945 arp who-has the-host-in-question (7:1c:c3:0:72:8c) tell
the-requester
15:31:01.040650 arp reply the-host-in-question is-at 0:d:88:e6:db:dc
15:32:01.308911 arp who-has the-host-in-question (4:f9:50:10:ff:ff) tell
the-requester
15:32:01.319515 arp reply the-host-in-question is-at 0:d:88:e6:db:dc
15:33:01.448065 arp who-has the-host-in-question (0:b0:2:0:25:f) tell
the-requester
15:33:02.448924 arp who-has the-host-in-question (2e:2f:30:31:32:33) tell
the-requester
15:33:02.573582 arp reply the-host-in-question is-at 0:d:88:e6:db:dc
15:34:00.568785 arp who-has the-host-in-question (0:b0:2:0:25:f) tell
the-requester
15:34:01.569537 arp who-has the-host-in-question (2e:2f:30:31:32:33) tell
the-requester
15:34:01.625362 arp reply the-host-in-question is-at 0:d:88:e6:db:dc
15:35:00.836038 arp who-has the-host-in-question (0:0:1f:0:a:c7) tell
the-requester
15:35:00.956094 arp reply the-host-in-question is-at 0:d:88:e6:db:dc
15:36:12.412916 arp who-has the-host-in-question (94:eb:ed:1a:71:fb) tell
the-requester
15:36:12.423227 arp reply the-host-in-question is-at 0:d:88:e6:db:dc
-----
'the-host-in-question' and 'the-requester' are, of course, IP addresses.
Thanks!
--
rea
BOFH excuse #158:
Defunct processes
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
postmaster@goldmedal.co.uk
This footnote also confirms that this email message has been swept by
MIMEsweeper 5.1 for the presence of computer threats.
www.clearswift.com
**********************************************************************
