1

In my Network are:

Router

Client 1: Victim

Client 2: Attacker (Raspberry Pi)

Client 3: My Computer (SSH to Raspberry)

All Clients are connected wireless to the router. All Clients are registered at the Router (IP/MAC bind) Router is set to accept connection only from registered Clients. Router has DHCP enabled. Programm used: dsniff/arpspoof

I arpsoofed client 1 and set Client 2 to act as MITM and forwarded the traffic. As soon as router refreshes arp tables it works. After 5-10 minutes the router assign a new IP to Client 1 and forgot the old IP Adress.

I've got 2 questions now:

What is IP/MAC binding for when its easy to manipulate one client to use multiple IPs and router accepting it?

How is it possible that the spoofed client 1 who shouldnt have any communication with the router directly is given a new IP after some time?

This is for education purposes only! Thank you !

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Feb 19, 2018 at 18:29

2 Answers 2

Reset to default
0

What you are describing is more about network disruption than information stealing. Also, clients don't register with routers, and DHCP is gratuitous in the situation you describe because the DHCP server plays no part in the situation.

There really isn't any such thing as IP/MAC binding they way you may think. You need to understand the network layers. Layer-2 is the local LAN, and all traffic on the local LAN is delivered directly from one host to another host by the LAN, e.g. MAC, address. Some layer-2 protocols use MAC addresses (either 48-bit or 64-bit MAC addresses), and some do not. Layer-3 is the network, and layer-3 protocols use layer-3, e.g. IP, addresses.

In order for one host on the LAN to send traffic to another host on the LAN, the host needs to resolve the destination layer-3 address into the destination layer-2 address in order to build a frame. That is where ARP (Address Resolution Protocol) comes in.

ARP maintains a table for translating layer-3 to layer-2 addresses. The entries in this table usually time out, but that depends on the OS. To get or update an entry in its ARP table, a host will use ARP requests. A host will also update its ARP table from any traffic it sees on the LAN. That means that when the victim sends out any traffic that the other hosts see, they will update their ARP tables with the new information. This could be the victim sending its own ARP request to discover the layer-2 address of another host, a gratuitous ARP, unknown unicast traffic, or unicast traffic to another host that updates it ARP table.

There is also something else to consider if this is a switched ethernet LAN. Ethernet switches maintain MAC address tables (not to be confused with ARP tables) to resolve the MAC address to an interface where the MAC address was last seen. A switch will update its MAC address table with a frame's source MAC address every time a frame comes into the switch, and it will use the MAC address table to determine to which switch interface it will send the frame with the destination MAC address. If the destination MAC address is not in its MAC address table, the switch will flood the frame to all the switch interfaces, except the one where the frame entered the switch.

Now, put it all together. If a malicious host tries to hijack a MAC address, it will only be temporary because the ARP tables in the other hosts will update, and the switch will constantly change the interface to which it delivers frames with that destination MAC address.

A real man-in-the-middle attack needs to happen on a link through which traffic must pass, but that is not the case on most LANs since traffic on LANs is passed directly from host-to-host, not through a single point.

Improve this answer
2
  • Thank you very much ! So if I understood you right the victim sends after a specific time an arp brodcast to all hosts included the switch/router which one than creates a new arp entry for the Victim mac adress? But isn't the new IP assignment a dhcp concern? Shouldn't the case I described work if I use static IPs because arpspoof is constantly spoofing arp entries and Victims IP can't change?
    – Sauseee
    Apr 5, 2017 at 15:19
  • The victim is going to send traffic, regardless, and any host receiving traffic from the victim, including a router, is supposed to update its ARP table with the information from that traffic. DHCP only assigns an IP address to a host, but it plays no part in the network traffic.
    – Ron Maupin ♦
    Apr 5, 2017 at 15:39
2

Ron has done a great job of explaining the concept. I just want to add my 2 cents for your specific scenario. You mentioned that you have arpspoofed client 1(victim) and client 3(attacker). In order to intercept all traffic (going to and from the victim), I assume you have arpspoofed between gateway and client 1(victim) as well. The whole point of this MITM attack is to manipulate the ARP tables(IP-Mac binding) of both the gateway(router) and the victim. In order to maintain the manipulated ARP tables for both the router and the victim, you need to keep sending the spoofed arp replies to both as long as you want to intercept the traffic.

Improve this answer
2
  • I actually keep sending arp replies. Everything is working so far for 5-10 minutes until the victim get a new IP. If after some time victim sends out arp broadcast i think router registers that there is a device with a mac that actually has no IP and sets one(with DHCP). After this my spoof fails because it is sending packets to the wrong IP. Is this possible?
    – Sauseee
    Apr 6, 2017 at 16:00
  • 1
    There is no reason for the router to reassign an IP address to the victim, 5-10 mins after you have instigated the arpspoof attack. This is because DHCP has leased an IP address to the victim(typically for 24hrs) and doesn't have reason to interfere and reassign the victim's IP address. All you are doing with arpspoof is lying to the victim about the router's mac address (replacing it with your own) and vice versa. The victim can only get a new IP address if it releases its IP manually, or the router releases dhcp/reboots or if the victim disconnects their WiFi.
    – comeunglued7
    Apr 6, 2017 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.