Task: 87 -> 88

140.112.31.87

140.112.31.88

87:87:87:87:87:87

88:88:88:88:88:88

ARP Request & Reply

140.112.31.87

140.112.31.88

87:87:87:87:87:87

88:88:88:88:88:88

ARP Poisoning

140.112.31.87

140.112.31.88

I know 140.112.31.88 => 88:88:88:88:88:88

87:87:87:87:87:87

88:88:88:88:88:88

140.112.31.89

89:89:89:89:89:89

Dynamic ARP Inspection(DAI)

Why not?

• DAI needs information in Layer 3
  • Must be Layer3 Switch
• Not flexible

Environment

• Layer2 switch
• Port security
  • Attacker can't fake mac address

1. Everything is fine

2. Attacker send arp reply

3. user update arp table

4. package redirect

5. package redirect

Monitor with Cisco switch

• Monitor in Cisco
  • Copy all packages from port to destination port

switch

monitor

PC

Monitor with other L2 switch

• Monitor -> Gateway
• Firewall

switch

monitor

PC

IP -> multiple MAC?

• user update arp table
• Possible reason:
  • change device
  • DHCP
  • attack

1 MAC -> multiple IP?

• Possible reason:
  • change IP
  • attack

Detect

• if MAC2 -> IP2 and previous IP1 && IP2 has its MAC1
  • ping IP2 with the MAC1
  • if received
    • ban MAC2

Re-Poisoning!