If you are paranoid about people ARP spoofing or flooding on your network you can use ARPWatch-NG, ARPWatch-NG is a continue of the popular original ARPWatch from ftp://ftp.ee.lbl.gov/.

ARPWatch monitors MAC adresses on your network and writes them into a file, last know timestamp and change notification is included.

It can be used it to monitor for unknown (and as such, likely to be intruder’s) mac adresses or somebody messing around with your ARP/DNS tables.

There have been quite a few fixes lately, so it’s recommended of course to get the latest version!

arpwatch NG 1.5:

try to report error on startup better _ arp.dat _ ethercodes.dat [FIXED]

arpwatch NG 1.4:

try to report _all anomalities via the report function _not syslog [FIXED]

mode 2 _ make action list parseable [FIXED]

further static’fy local functions in arpwatch.c [FIXED]

ethercodes updated from nmap-4.11 and removed old ones [UPDATED]

arpwatch NG 1.2:

on make install also install man-pages [FIXED]

ethercodes updated from nmap-4.00 [UPDATED]

You can download the latest version of ARPWatch here.

There are 2 basics mode:
– who-has: build a request ARP message.
– reply: build a reply ARP message (default)

Other advanced modes should come very soon
– arping: send a who-has to every host on the LAN to see who is here
– promisc: detection of boxes that are sniffing on the network using promiscuous mode of their network interface
– arpmim: perform Man in the Middle attack

Link level options

-s: set the source address of the packet.
Default : MAC address of the interface used to send the packets.

-d: set the destination address of the packet
Default: broadcast

These 2 options have a strong influence on the ARP message itself.
Here are the default according to these options:

– request

      # ./arp-sk -i eth1 -w
      + Running mode "who-has"
      + IfName: eth1
      + Source MAC: 52:54:05:f4:62:30
      + Source ARP MAC: 52:54:05:f4:62:30
      + Source ARP IP : 192.168.1.1 (batman)
      + Target MAC: ff:ff:ff:ff:ff:ff
      + Target ARP MAC: 00:00:00:00:00:00
      + Target ARP IP : 255.255.255.255 (255.255.255.255)

– reply

      # ./arp-sk -i eth1 -r
      + Running mode "reply"
      + IfName: eth1
      + Source MAC: 52:54:05:f4:62:30
      + Source ARP MAC: 52:54:05:f4:62:30
      + Source ARP IP : 192.168.1.1 (batman)
      + Target MAC: ff:ff:ff:ff:ff:ff
      + Target ARP MAC: ff:ff:ff:ff:ff:ff
      + Target ARP IP : 255.255.255.255 (255.255.255.255)

The only difference comes from the destiantion mac address from ARP message, since it has to be 00:00:00:00:00:00. For the reply mode, consistency is preserved and the destination MAC address used for the link layer is copied in the ARP message.

You can download arp-sk here:

arp-sk-0.0.16.tgz

Now this is a VERY interesting project, as I’ve always said the majority of DoS attacks and DDoS attacks (90%+) could be stopped if all the ISP’s null routed packets which DO NOT originate from IP blocks they own, e.g. spoofed packets.

Basically the project has been established to see if you can spoof IP packets or not, and what percentage of ISPs already drop the packets.

It seems in general about 20-25% of systems are able to spoof packets.

The classic design tenets of Internet architecture produced a network capable of remarkable scalability while relegating security to the end hosts. As a result, the public Internet includes no explicit notion of authenticity and will forward packets with forged headers. Malicious users capitalize on the ability to “spoof” source IP addresses for anonymity, indirection, targeted attacks and security circumvention. Compromised hosts on networks that permit IP spoofing enable a wide variety of attacks. Despite being first exploited over two-decades ago, IP spoofing is a persistent problem and a continued threat. In addition to mounting spoofed-source bandwidth-based denial-of-service (DoS) attacks, new exploits utilizing IP spoofing surface regularly.

You can read more of the intro to the ANA spoofing project here.

Some may suspect the project and the software involved is somewhat nefarious, but oh well, if you are going to get r00ted by someone, let it be MIT ok? Anyway you can always run it in a sandbox or in a fresh VMware machine.

If you don’t care either way, you can download the spoofer software here.

Please note though, it won’t run under Windows XP SP2, due to the whole raw sockets issue I would imagine.

The majority of systems tested so far have been Windows systems though (64%).

A summary of the results:

Total Completely Failed Spoof Attemps: 1823
Failed as a result of Windows XP SP2: 528
Failed as a result of (non-Windows) Operating System block: 111
Failed as a result of being Behind a NAT: 702

The various types of tests show which restrictions are in place.

A full summary of the results are here.

Digg This Article