10

I am playing around with Ettercap and ARP spoofing attacks. I have noticed that the computers that are involved in my attack not are displaying any messages telling that an IP conflict has occured.

Isn't that the case when ARP spoofing? Then two (or more) computers will share the same IP. When does an IP conflict occur?

The computers I spoof are a Windows 7 and Ubuntu machines.

Polynomial
  • 132,208
  • 43
  • 298
  • 379
Rox
  • 801
  • 3
  • 10
  • 17
  • Who knows, may be your router picks IPs for DHCP leases from its ARP cache table (you can never know what those folks code up for your next $15 router)... – JSmyth May 16 '14 at 17:40
  • Nevertheless, I guess that "IP conflict" thingy may be related to the fact that before using IPv4 address a Windows host tests to see if the address is already in use by broadcasting ARP probe packets. Hence, if there's some kind of tomfoolery with ARP packets over the network, responsea may be incorrect. – JSmyth May 17 '14 at 14:56

3 Answers3

9

Get to the roots ! If you know what ARP does, things will be clearer.

On a subnet (machines plugged into the same set of hubs and switches), the machines talk to each other with MAC addresses: the MAC address uniquely identifies each ethernet/WiFi card. Machines, a priori, do not know MAC addresses; they just know IP addresses. So, when machine A wants to send a packet to machine B, it sends a broadcast frame following the ARP protocol; the packet says: "hey, does anybody knows the MAC address of B" ? If someone responds with the information ("B has MAC address xx:xx:xx:xx:xx:xx") then A will be able to send its data to B.

To speed up the process, A maintains a cache of known mappings IP-to-MAC, but is ready to remove entries from the cache when the information is not renewed (information renewal is when a packet comes to A, tagged with the IP address of B as source, and, at the ethernet level, uses the MAC address of B). The ARP cache entries must not be too long-lived because B is allowed to switch hardware (in case B's ethernet adapter fries and is replaced, the new adapter will have a distinct MAC address, but may assume the same IP address).

Other users of ARP are switches. Switch do not emit packets, but they observe a lot. The point of a switch, as opposed to a simpler hub, is to optimize things by sending packets only on relevant cables, instead of broadcasting all packets over the complete subnet. A switch "knows" that a given machine (i.e. a MAC address) lies at the other end of a specific link by observing traffic (i.e. the switch has noticed that all packets with that MAC address as source come from a given link). The switch maintains thus a mapping MAC->link in an internal table, which is confusingly (and inappropriately) also called an "ARP cache".

Spoofing is the term some people came up with to designate what is otherwise known as a forgery, when in the context of network security (for some reason, perfectly usable words from previous centuries never seem to be good enough for the technology-addict). ARP spoofing is about sending packets which are forged at the ARP level, i.e. packets which will deceive other systems as to the mappings involving ARP (i.e. the ARP caches that machines and switches maintain). The attacker may gain some advantages so doing; for instance, he may convince a switch to send him some packets which would otherwise have been sent to another machine on another link. This kind of attack is also know as "ARP cache poisoning" because it ultimately fills some ARP caches with wrong entries.

An IP conflict is when two machines, with distinct MAC addresses, want to assume the same IP. When an ARP request is sent ("what is the MAC address of B"), both machines will respond, with conflicting information. The requester (A) receives both answers and can warn about the problem: two concurrent mappings with one IP and two MAC addresses. ARP spoofing tries to do something different: two IP addresses (or two links) which map to one MAC address. The successful ARP attack is not really distinguishable from a machine which changed its IP address, something which, on a general basis, is normal (when machines get IP addresses dynamically with DHCP, their IP address may change from time to time), and thus triggers no special warning.

Tom Leek
  • 168,808
  • 28
  • 337
  • 475
  • 2
    I've thought of this question myself sometimes, and I'm not sure I understand the point that the answerer is trying to make here in the last paragraph. It's true that from the spoofing machine's viewpoint it is trying to take on two IP addresses mapped to one MAC address (its own). But isn't the *spoofed* machine still on the network as well, still sending out ARP packets that say "I have IP address A" at the same time the spoofing machine is sending out "I have IP address A". That's two distinct machines saying they have IP address A, isn't it? What am I missing? – mostlyinformed Dec 20 '15 at 02:41
5

When ARP Poisoning You are poisoning the ARP tables. If computer 10.1.1.1 needs to get to computer 10.1.1.2, it keeps the MAC address in its ARP tables. ARP is a trusting protocol, which means when a computer responds to a ARP request, there is nothing requiring its response to be correct and no mechanism for verifying it is correct.

So here's the game plan.

  1. Victim sends out arp request for 10.1.1.1.
  2. Legitimate 10.1.1.1 responds with its MAC Address, but I (the attacker) send out 10 million responses.
  3. As long as 1 of my ARP responses gets sent after the legitimate one, the attacker's MAC address will be put into the victim's ARP table.

One interesting thing about ARP is that the victim doesn't need to send out an ARP request to poison them. Like I said, ARP is poisoning them.

IP Addressing Spoofing I pick an IP address that already exists on my network. Other Hosts will have issues establishing a TCP connection. For example. The legitimate host that the attacker is spoofing tries to access a webserver. The legitimate host sends a SYN, the legitimate webserver sends an ACK that both the attacker AND the legitimate host responds to. The legitimate host responds with a SYN-ACK like they should. The attacker responds with a RST since they ACK is unexpected to it. It makes it really difficult (impossible) for a IP address being spoofed to use any TCP services.

I'm having trouble interpreting your question (I'm bad at reading) but hopefully this helps.

Luc
  • 31,973
  • 8
  • 71
  • 135
  • 1
    Ahhh, so it's the *frequency* with which the attacker sends out ARP spoofing packets vs. the "legitimate" IP address owner's ARP packets that is key. Even though the legitimate owner is still sending out ARP packets saying it has IP address A those packets are being drowned out by the far more numerous packets from the attacker-controlled machine saying it has IP address A. But does that mean that if the legitimate-owner-machine and the attacker-controlled machine were both sending out about the same number of ARP packets an IP conflict *would* emerge? (3 years after this answer...) – mostlyinformed Dec 20 '15 at 03:14
2

ARP Spoofing is NOT the same as IP address spoofing.

What ARP spoofing does is associate a MAC Address with an existing IP Address. The exploit involves sending fake ARP reply packets that will associate the attackers MAC address with a legitimate IP address. This involves making use of the fact that the ARP protocol is stateless - it doesn't keep track of any changes. New ARP reply packets will override the old ARP entries in the cache.

To any hosts in the network, they will only see one IP address associated to one MAC address (the attackers MAC).

  • @TerryChia: I see. But I have experienced IP address conflicts before, are not them associated to ARP requests/replies? – Rox Aug 25 '12 at 12:43
  • @Rox Most probably not. It might be some misconfiguration with your DHCP server if you are using DHCP, or a conflicting static IP assignment. Hard to tell really without more info. –  Aug 25 '12 at 12:47
  • @Rox "_But I have experienced IP address conflicts before_" how do you know you had "IP address conflicts"? – curiousguy Aug 25 '12 at 14:59
  • @curiousguy: I don´t remember in what situations I have got IP conflicts. But I know I have some times before, probably when I have installed routers and connected clients to it. – Rox Aug 27 '12 at 14:37
  • (Three-plus years later...) Okay, but here's what I personally don't understand about this scenario: in ARP spoofing isn't the machine that "rightfully" has the IP address that the attacker is trying to assume also *still* sending out ARP packets saying it has that IP? Isn't that creating a situation where you do have two different machines, with two different MACs, both saying they have one IP address? Wouldn't the ARP cache of a third machine looking at all this keep flipping back and forth between "Computer at MAC X has IP address A.", and "Computer at MAC Y has IP address A."? – mostlyinformed Dec 20 '15 at 02:59