0

Let's say a malicious host connects to a network. It doesn't wish to identify itself to other devices on the network unless it wants to (eg: for a desired conversation). From what I understand, the standard way to scan for all devices on a network is through a program such as WNetWatcher which will issue an ARP request to every IP address on the network subnet, to which it receives an ARP response for every device.

Could the malicious host simply not respond to the ARP request, and thus remain hidden?

Improve this question
1
  • Yes. Of course, it also won't be able to communicate on that network. If it doesn't have an address in that network, it wouldn't respond anyway.
    – Ricky
    Jan 18 at 7:14

1 Answer 1

Reset to default
0

Yes, of course. A lurking intruder could simply listen to traffic that "comes by". Whether it deactivates its IP stack in total or just the ARP responder doesn't really matter.

However, a passive scan - without originating any traffic - only works on bus-type networks, most prominently Wi-Fi.

Wired, switched networks like Ethernet forward frames only as required, so a passive listener just receives broadcast traffic - that would show IP and MAC addresses for active hosts within the broadcast domain as well, but next to nothing regarding services (and potential vulnerabilities). Of course, it would reveal itself on a managed switch by creating a link "up" without a MAC address associated to the port.

Improve this answer
1
  • And flooded unknown unicast. It's a small distinction, but one that does come in handy.
    – Ricky
    Jan 18 at 7:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.