Fwd: MAC / IP conflict

Fwd: MAC / IP conflict

[Jad Saklawi]

----- Forwarded message from Hisham Mardam Bey -----
    Date: Sun, 21 Mar 2004 13:52:59 +0200

In short, I need to detect when someone on the network uses my MAC and
my IP address.

Longer story follows. I am on a LAN which might have some potentially
dangerous users. Those users might spoof my MAC address and additionally
use my IP address, thus forcing my box to go offline, and not be able to
communicate with my gateway. What I need is a passive way to check for
something of the sort, and perhaps a notofication into syslog (the
latter is not very important).

Re: Fwd: MAC / IP conflict

[Filippo Carone]

Il dom, 2004-03-21 alle 06:09, Jad Saklawi ha scritto:
> ----- Forwarded message from Hisham Mardam Bey -----
>     Date: Sun, 21 Mar 2004 13:52:59 +0200
> 
> In short, I need to detect when someone on the network uses my MAC and
> my IP address.
> 
> Longer story follows. I am on a LAN which might have some potentially
> dangerous users. Those users might spoof my MAC address and additionally
> use my IP address, thus forcing my box to go offline, and not be able to
> communicate with my gateway. What I need is a passive way to check for
> something of the sort, and perhaps a notofication into syslog (the
> latter is not very important).

maybe using ettercap would ease the task of finding spoofers

Cheers,
Filippo Carone

Re: Fwd: MAC / IP conflict

[Bill Davidsen]

Jad Saklawi wrote:
> ----- Forwarded message from Hisham Mardam Bey -----
>    Date: Sun, 21 Mar 2004 13:52:59 +0200
> 
> In short, I need to detect when someone on the network uses my MAC and
> my IP address.
> 
> Longer story follows. I am on a LAN which might have some potentially
> dangerous users. Those users might spoof my MAC address and additionally
> use my IP address, thus forcing my box to go offline, and not be able to
> communicate with my gateway. What I need is a passive way to check for
> something of the sort, and perhaps a notofication into syslog (the
> latter is not very important).

Use arpwatch, it detects ALL changes of IP<=>MAC mapping.

-- 
bill davidsen <davidsen@tmr.com>
   CTO TMR Associates, Inc
   Doing interesting things with small computers since 1979

Re: Fwd: MAC / IP conflict

[Willy Tarreau]

Hi,

On Sun, Mar 28, 2004 at 10:58:16PM -0500, Bill Davidsen wrote:
> Jad Saklawi wrote:
> >----- Forwarded message from Hisham Mardam Bey -----
> >   Date: Sun, 21 Mar 2004 13:52:59 +0200
> >
> >In short, I need to detect when someone on the network uses my MAC and
> >my IP address.
> >
> >Longer story follows. I am on a LAN which might have some potentially
> >dangerous users. Those users might spoof my MAC address and additionally
> >use my IP address, thus forcing my box to go offline, and not be able to
> >communicate with my gateway. What I need is a passive way to check for
> >something of the sort, and perhaps a notofication into syslog (the
> >latter is not very important).
> 
> Use arpwatch, it detects ALL changes of IP<=>MAC mapping.

It won't tell him when someone else uses both IP and MAC. The real solution
is to lock the MAC on the switch if possible. Another one is to use a second
host to launch regular ARP requests and count how many replies it gets. Note
that it is also possible to do this from his host, but he will need arping
and tcpdump in promiscuous mode, because the reply address will have to be
a fake one (MAC and IP) so that the switch forwards the reply on all ports.

Completely passive solution will not always detect the event. The attacker
might send packets to another host or even to the switch itself, which will
not propagate to other ports (eg: ethernet loopback with SA=DA= his MAC).
But if they make a mistake, then listening to all incoming packets and logging
their source MAC when it's the same as his host might work. This can be
implemented very easily with arptables but just for ARP requests. ebtables
might be better suited, but needs to configure a bridge which is dangerous.

Hmmm this reminds me good memories... :-)
Willy

Re: Fwd: MAC / IP conflict

[Bill Davidsen]

Willy Tarreau wrote:
> Hi,
> 
> On Sun, Mar 28, 2004 at 10:58:16PM -0500, Bill Davidsen wrote:
> 
>>Jad Saklawi wrote:
>>
>>>----- Forwarded message from Hisham Mardam Bey -----
>>>  Date: Sun, 21 Mar 2004 13:52:59 +0200
>>>
>>>In short, I need to detect when someone on the network uses my MAC and
>>>my IP address.
>>>
>>>Longer story follows. I am on a LAN which might have some potentially
>>>dangerous users. Those users might spoof my MAC address and additionally
>>>use my IP address, thus forcing my box to go offline, and not be able to
>>>communicate with my gateway. What I need is a passive way to check for
>>>something of the sort, and perhaps a notofication into syslog (the
>>>latter is not very important).
>>
>>Use arpwatch, it detects ALL changes of IP<=>MAC mapping.
> 
> 
> It won't tell him when someone else uses both IP and MAC. The real solution
> is to lock the MAC on the switch if possible. Another one is to use a second
> host to launch regular ARP requests and count how many replies it gets. Note
> that it is also possible to do this from his host, but he will need arping
> and tcpdump in promiscuous mode, because the reply address will have to be
> a fake one (MAC and IP) so that the switch forwards the reply on all ports.

If he sees the packet it should alert on the local MAC or IP on an 
external packet. As noted you won't get the external packet in all cases.
> 
> Completely passive solution will not always detect the event. The attacker
> might send packets to another host or even to the switch itself, which will
> not propagate to other ports (eg: ethernet loopback with SA=DA= his MAC).
> But if they make a mistake, then listening to all incoming packets and logging
> their source MAC when it's the same as his host might work. This can be
> implemented very easily with arptables but just for ARP requests. ebtables
> might be better suited, but needs to configure a bridge which is dangerous.

I like the idea of sending ARP after changing the MAC. I would hope to 
have an option in the switch which prevents MAC takeover by locking the 
MAC to a port as long as the link is up. This doesn't prevent sending a 
packet to another host with the real (evil) MAC and spoofed IP, to set 
the arptable in a single host. In the long run help from the switch is 
probably needed to do it right.

-- 
    -bill davidsen (davidsen@tmr.com)
"The secret to procrastination is to put things off until the
  last possible moment - but no longer"  -me