3
2
TLDR ARP Poisoning doesn't change the IP dst in the table so why does spoofing the MAC under another IP address help to redirect the traffic?
Any video I find explains that the goal of ARP poisoning is to send an unsolicited message to 'overwrites' the host's & router's ARP table so that the MitM attacker's MAC address is associated with both so that they look like so:
Victim: aa:bb:cc:dd:ee:ff (192.168.1.100) Router: aa:bb:cc:dd:ee:ff (192.168.1.1) MitM Machine: aa:bb:cc:dd:ee:ff (192.168.1.199)
In this way both end up sending to the Man in the Middle who will then forward to the endpoints 192.168.1.199 and 192.168.1.1, which actually had another MAC address.
...My question is how does that work? If you are tricking these devices into associating the wrong MAC with the correct IP, how is the traffic actually re-routing? What I mean is how I see it is like this:
Victim > packet to router at 192.168.1.1 > gets to router and opens up the packet to find that the MAC is wrong?
Ah thanks.. I can't really find a model of how MAC addresses are actually used in the routing. I thought the IP was always used to route. On the LAN side it just says "send this data to this MAC" and off it goes through the switches and router (LAN side)? ... I see what you mean now that the MitM simply forwards it on to the router and perhaps uses itself as the return MAC address. – SomeRandomGuy12345 – 2015-07-16T12:18:21.510
@SomeRandomGuy12345 OSI layer : Ethernet and IP address has a nice explanation
– DavidPostill – 2015-07-16T12:24:27.720