1

So here's my understanding of ARP spoofing. I'm malicious, and I want you to think I'm the gateway. So when you ask "if you're the gateway, please reply with your MAC", I reply, "I'm the gateway, here's my MAC". Right?

What I don't get is, why can't the gateway just block those replies? Because the gateway knows that it is the gateway. Which means other computers aren't the gateway. Which means if someone else says they're the gateway, they must be lying. So why would the gateway forward their lies?

So two questions. First, if this isn't a thing, why isn't this a thing? Second, if this is a thing, why isn't it widespread? Because I know ARP spoofing works on most home/small business routers, at least.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 15, 2017 at 5:36

2 Answers 2

Reset to default
2

First off - it's certainly a thing. ARP was never intended to be a secure protocol and is utterly distributed in operation.

The gateway in a given subnet isn't special - it's just another host with an IP address and an associated MAC. Barring any special functional/security measures, the L2 environment is going to flood every ARP request to every host in the broadcast domain and, in turn, is going to also flood any ARP responses - which, unfortunately, could include a spoof. In short, the gateway is just another host answering ARP queries and has nothing to do with their distribution or validation.

So why isn't this more common? The first reason is that competing ARP responses are going to end up causing end hosts to just lose connectivity as often as cleanly hijacking the gateway. It's basically a duplicate IP, after all. The second reason is that, well, it isn't that uncommon as an accidental misconfiguration but it tends to be so blindingly obvious as to be not all that terribly effective as anything other than an annoyance.

EDIT (to answer question in comments about hosts losing connectivity):

So let's say the gateway is at 192.168.1.1 with a MAC of aaaa.bbbb.cccc. Under normal circumstances whenever a host ARP's for its gateway it will send a message saying "Who has 192.168.1.1, tell xxx" and the router responds with "192.168.1.1 is at aaaa.bbbb.cccc". When an ARP spoof occurs the same request ("who has 192.168.1.1, tell xxx") will be met with two responses - one being the correct one (aaaa.bbbb.cccc) and the other being the spoof (say dddd.eeee.ffff). For the hosts listening for this information they'll take the first response they see and in practice it's the luck of the draw which response (fake or real) shows up in what order and, as such, it's pretty likely that the various hosts on the subnet are going to be churning their ARP tables between the real and fake gateways. This is going to manifest as inconsistent connectivity problems (ARP changes aren't instantaneous on the end hosts) as well as a slew of log messages about duplicate IP's on the subnet.

Improve this answer
8
  • Can you elaborate on "ARP responses are going to end up causing end hosts to just lose connectivity..."?
    – Elliot Gorokhovsky
    Commented Dec 3, 2016 at 23:30
  • see the edit in the message
    – rnxrx
    Commented Dec 3, 2016 at 23:40
  • why would their arp tables be "churning" though? wouldn't they just pick one (me or the router) and be done with it?
    – Elliot Gorokhovsky
    Commented Dec 3, 2016 at 23:51
  • 1
    Because as soon as they see a new announcement they'll update their tables.
    – rnxrx
    Commented Dec 4, 2016 at 1:36
  • Right. So they would get two announcements, two updates, then they're connected again. 50% of MITM.
    – Elliot Gorokhovsky
    Commented Dec 4, 2016 at 1:47
1

So when you ask "if you're the gateway, please reply with your MAC", I reply, "I'm the gateway, here's my MAC". Right?

Correct.

So why would the gateway forward their lies?

It does not. ARP traffic stays within a broadcast domain, so it won't pass the gateway, it's all switched, not routed.

Second, if this is a thing, why isn't it widespread?

I'm not sure what makes you think it's not (and I'm also not sure if it is or is not), but the main reason is that to do ARP spoofing, you need to be in the same layer 2 broadcast domain, which makes it hard(er) to do remotely.

Improve this answer
2
  • "switched, not routed". What does this mean? Don't all ethernet frames have to go through the gateway? And aren't ARP replies ethernet frames?
    – Elliot Gorokhovsky
    Commented Dec 3, 2016 at 23:35
  • 1
    No, they don't. The difference between switching and routing is considered basic knowledge here, there are numerous resources on the internet explaining the differences.
    – Teun Vink
    Commented Dec 3, 2016 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.