Full Disclosure mailing list archives
Re: info on ip spoofing please
From: Brandon Enright <bmenrigh () ucsd edu>
Date: Tue, 11 Apr 2006 20:42:21 +0000
On Tue, 2006-04-11 at 20:37 +0100, Ian stuart Turnbull wrote:
Hello all, At http://www.iss.net/security_center/advice/Underground/Hacking/Methods/Technical/Spoofing/default.htm was this comment :- QUOTE " Examples of spoofing: man-in-the-middle packet sniffs on link between the two end points, and can therefore pretend to be one end of the connection " My question is How can you sniff packets on a link that your machine is NOT on ie NOT on the same subnet?? Why am I at a loss to understand this. Is there a command/software that allows one to say: sniff packets on port x of IP xxx.xxx.xxx.xxx ? Please put me out of my agony on this. Thanks for any info you can give. Ian t
In general you can not arbitrarily monitor the traffic of any random host. If the host you are trying to attack is not relatively local there is little to no chance you'll be able to sniff the traffic. For more local hosts though, if you can directly influence the network devices separating you from your victim there is a chance you will be able to redirect traffic for an attack. The two more common methods for performing MITM attacks are ARP spoofing and Spanning Tree spoofing. Several tools can perform ARP poisoning (ettercap comes to mind). There is an excellent overview of attacks with Spanning Tree in Cisco's _Network Security Architectures_ (ISBN: 1-58705-115-X). If you goal isn't to modify the stream for a MITM attack but just watch the traffic, CAM table flooding can reduce the switch/vLAN to the behavior of a hub. For a discussion of all of these attacks see http://www.rootsecure.net/content/downloads/pdf/layer2sniffing.pdf All that being said, it still may not be possible to manipulate the network in any useful way. Cisco and other vendors have mechanisms that can be turned on for most of their devices that detect and prevent many or all of the above attacks. For those with Cisco devices looking to protect against said attacks, limiting the number of MACs per port and turning on BPDU Guard (http://www.cisco.com/warp/public/473/65.html) is typically all that needs to be done. Regards, Brandon -- Brandon Enright Network Security Analyst UCSD ACS/Network Operations bmenrigh () ucsd edu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- info on ip spoofing please Ian stuart Turnbull (Apr 11)
- Re: info on ip spoofing please Michael Holstein (Apr 11)
- Re: info on ip spoofing please Brian Eaton (Apr 11)
- Re: info on ip spoofing please Ian stuart Turnbull (Apr 11)
- Re: info on ip spoofing please Brian Eaton (Apr 11)
- Re: info on ip spoofing please Brian Eaton (Apr 11)
- Re: info on ip spoofing please Michael Holstein (Apr 11)
- Re: info on ip spoofing please Brandon Enright (Apr 11)
- Re: info on ip spoofing please Ian stuart Turnbull (Apr 11)
- Re: info on ip spoofing please Valdis . Kletnieks (Apr 11)
- Re: info on ip spoofing please Ian stuart Turnbull (Apr 11)
- Re: info on ip spoofing please Brandon Enright (Apr 11)
- Re: info on ip spoofing please Ian stuart Turnbull (Apr 11)
- Re: info on ip spoofing please Ian stuart Turnbull (Apr 11)
- <Possible follow-ups>
- RE: info on ip spoofing please Neil Davis (Apr 12)
- RE: RE: info on ip spoofing please Ian stuart Turnbull (Apr 12)
- RE: RE: info on ip spoofing please Arley Barros Leal (Apr 12)
- RE: RE: info on ip spoofing please Ian stuart Turnbull (Apr 12)