Ettercap and DHCP Server

Data that travels over the air and how to protect (or decipher) it

Ettercap and DHCP Server

Post by migueldomingos on Sun Apr 22, 2012 11:40 am
([msg=65872]see Ettercap and DHCP Server[/msg])

I'm using Ettercap on several routers and I discovered one router that gives dynamic ip adresses but once a mac address is given an ip adress this address will be used for every connection of this mac with the router. This is a rule of the DHCP server for the router.

This is giving me trouble trying to ARP poisoning victims since I try to poison a victim and the router doesn't believe on my ARP packets and continues using the mac address of the victim (not mine). The victim computer is sucessfully poisoned (saw its arp table).

Is there any way I can do the ARP poisoning attack in this router?
New User
New User
Posts: 1
Joined: Sun Apr 22, 2012 11:30 am
Blog: View Blog (0)

Re: Ettercap and DHCP Server

Post by FunctionCreep on Fri Apr 27, 2012 5:55 am
([msg=65976]see Re: Ettercap and DHCP Server[/msg])

I'm not getting 100% what it is that you're trying to achieve.

ARP uses MAC addresses by design so that is why it's not "believing" you. Are you trying to redirect data from going to the original (A) MAC holder and instead they come to you (B) ?

One solution is spoofing (B)'s MAC address to the same as of (A)'s. That can lead to weird behaviour which depends on how the router's ARP tables are set and whether the ARP poison attack will be fended off. e.g. if the router has static ARP tables then this kind of attack won't have an effect. You also have to keep in mind the IP addresses of the network, you CANNOT HAVE DUPLICATES.

Another solution is becoming an ARP proxy and essentially take over the router responsibilities to your own machine thus being able to control and monitor all traffic on the network. This is both an MiTM attack as well as an ARP spoof attack.
"I hope for nothing. I fear nothing. I am free." ~ Nikos Kazantzakis
User avatar
Experienced User
Experienced User
Posts: 92
Joined: Tue May 18, 2010 6:19 pm
Blog: View Blog (0)

Return to Networking

Who is online

Users browsing this forum: No registered users and 0 guests