Am I having an ARP Poisoning Attack?

Data that travels over the air and how to protect (or decipher) it

Am I having an ARP Poisoning Attack?

Post by barneystinson19 on Wed Nov 28, 2012 4:00 pm
([msg=71395]see Am I having an ARP Poisoning Attack?[/msg])

Hi again!
So its like this, My local network IP is 192.168.1.102 but when I traceroute to www.facebook.com (or any other website) first packet goes from 192.168.1.1 Also Firefox is keep saying "This connection is not reliable!" to all websites. So am I under an ARP Poisoning Attack? If I'm how can I block it? I'm not a network guy so please keep it simple :oops: Thanks!
"Ömür dediğin üç gündür, dün geldi geçti yarın meçhuldür…O halde ömür dediğin bir gündür,o da bugündür…."
User avatar
barneystinson19
Experienced User
Experienced User
 
Posts: 50
Joined: Fri Nov 02, 2012 3:49 pm
Blog: View Blog (0)


Re: Am I having an ARP Poisoning Attack?

Post by LoGiCaL__ on Wed Nov 28, 2012 8:03 pm
([msg=71398]see Re: Am I having an ARP Poisoning Attack?[/msg])

192.168.1.1 is your routers ip address. This is why it's the first response you see in the tracert. Just that alone wouldn't raise any suspicion of arp poisoning. If you are concerned about it you can get a packet analyzer such as wireshark and check the network traffic. If you are being arp poisoned you should see continuous packets being sent to your computer with your routers address not just a packet sent every so often. I would also suggest to keep the connections of your pc to a minimum while looking into this.
User avatar
LoGiCaL__
Addict
Addict
 
Posts: 1060
Joined: Sun May 30, 2010 12:33 pm
Blog: View Blog (0)


Re: Am I having an ARP Poisoning Attack?

Post by barneystinson19 on Thu Nov 29, 2012 2:28 pm
([msg=71407]see Re: Am I having an ARP Poisoning Attack?[/msg])

How can I protect from it without any programs?
"Ömür dediğin üç gündür, dün geldi geçti yarın meçhuldür…O halde ömür dediğin bir gündür,o da bugündür…."
User avatar
barneystinson19
Experienced User
Experienced User
 
Posts: 50
Joined: Fri Nov 02, 2012 3:49 pm
Blog: View Blog (0)


Re: Am I having an ARP Poisoning Attack?

Post by limdis on Thu Nov 29, 2012 5:15 pm
([msg=71413]see Re: Am I having an ARP Poisoning Attack?[/msg])

Without programs you need to monitor your network to ensure that any and all connections belong to you. ARP poisoning/spoofing/mitm can only work if access to your network is compromised.
"The quieter you become, the more you are able to hear..."
"Drink all the booze, hack all the things."
User avatar
limdis
Moderator
Moderator
 
Posts: 1319
Joined: Mon Jun 28, 2010 5:45 pm
Blog: View Blog (0)


Re: Am I having an ARP Poisoning Attack?

Post by LoGiCaL__ on Thu Nov 29, 2012 10:34 pm
([msg=71420]see Re: Am I having an ARP Poisoning Attack?[/msg])

This article mentions a few preventative steps. The most effective probably being a static arp table.

http://toschprod.wordpress.com/2012/03/04/mitm-8-countermeasures/
User avatar
LoGiCaL__
Addict
Addict
 
Posts: 1060
Joined: Sun May 30, 2010 12:33 pm
Blog: View Blog (0)



Return to Networking

Who is online

Users browsing this forum: No registered users and 0 guests