Network APR Problem

[a_c_i_d_b_u_r_n]

Recently I've been playing with APR using Cain but have only experienced minor success.
I have a list of IPs and MAC addresses on the network and I have identified the default gateway so that I can set up the appropriate poisoning.

However the packets that get sniffed all seem to be on connections within my own subnet... hence I can pick up connections to webmail etc. that run within my subnet but not connections to the global internet.

Any ideas how to sniff connections to the global internet rather than just connections within my subnet? Is this a security measure that has been taken and is beyond my control?

Thanks.

[193zaitsev]

ARP resolves MAC - IP translations on the system's local network, not the entire internet.

[a_c_i_d_b_u_r_n]

ARP resolves MAC - IP translations on the system's local network, not the entire internet.

Thanks for that, I sort of knew what was going on but couldn't work it out completely.

The problem I have now is that I only get half-routing on the connection that I need to full-route. I read up on this and think it's a security measure called DHCP Snooping. I tried spoofing MAC and IP addresses to no avail. Any ideas how to get full-routing past DHCP Snooping?

[int3grate]

The problem I have now is that I only get half-routing on the connection that I need to full-route. I read up on this and think it's a security measure called DHCP Snooping. I tried spoofing MAC and IP addresses to no avail. Any ideas how to get full-routing past DHCP Snooping?

You must either A, have some really nice networking equipment. Or B, be on a business/industry/education network that has nice networking equipment. "DHCP snooping" is a mechanism on the networking equipment that keeps a table of IPs given out through DHCP mapped to their respective MAC addresses. If someone sends an invalid ARP reply or broadcast out, the networking equipment recognizes it and drops the packets because because the IP address and MAC address doesn't match up to what's stored in the table.

The only networking equipment I've seen that supports this is higher end cisco catalyst switches. There might be more, but I don't have any experience with them. The answer to your question is no. You can't bypass or get around DHCP snooping. Furthermore, you shouldn't be performing these types of attacks on production networks, or any network that you do not own and control.

Int3grate