To protect me from ARP spoofing, I tried most of the programs spread here and there and read most of the scientific papers on this subject, but I found a lot of ignorance and evasiveness to hide a bitter truth.
According to my research, all the proposed solutions talk about protecting your computer only, but they completely ignore the protection of the router.
I can divide the attack into two classes:
- attacking the victim directly, and this is easy to detect and protect from, and this is what most, if not all, known programs address. (static arp solve this)
- attacking the router directly without attacking the victim directly, so the attacker can eavesdrop on all calls with the router made by the victim, without leaving any traces, I could not find any program that detect this attack, but one dead program, which is
antiarp
.
This way I can throw away all the popular programs like XArp
and ARP AntiSpoofer
, they are useless for the case 2.
So nice, the problem is that I was able to make a script thanks to Scapy
and Python
to attack the router, and I was able to eavesdrop on all the calls of the victim without the victim being able to discover me except as I said one program which is antiarp
. and it works like that: it reads all the packets and if it discovers that one of the packets did not come from the router, then this is undoubtedly an attack if the src ip is not a local IP. I was able to create a script also using the method used by antiarp
, and this rule is enough to detect this attack
sniff(prn=alertme,filter="ip and (ether src not routerMAC and not src net 192.168.1.0/24))"
so far so good.
The problem is that I can easily change the attacker MAC :/, and then the antiarp
or my script fails to detect this attack, and I tried to find some way to discover this attack, but I failed in a dramatic way.
Do you know a way to at least detect this type of attack without buying an advanced router, I mean using the simple routers that telecom companies give us. My router does not have any cool features, I am looking for a solution by which I can detect this attack without changing the router.
I tried all of this on Windows, but if there is a solution on Linux, then tell me please, I may find a way from it to apply it on windows.
So my question is how can I detect a MAC spoof
like the one used by Scapy
by rebuilding the packet?
I know it is easy to detect permanent change of MAC using SMAC
...etc, but changing the MAC using Scapy
is so dangerous, undetectable and silent like the death, it replicate the router without changing the attacker MAC permanently, so a simple MAC scan will not show me that there is a duplicate MAC in my LAN... any help please? can this even be detected?
reading on Stackoverflow and Stackexchange sites I can find few cryptic comments that show that some professionals know about this, But I have not been able to find anyone who talks about this problem in detail, they always talk in a vague manner without giving details and therefore do not give solutions.