Right.
So let's talk about how we can detect P poisoning attacks first of all let me show you the AARP tables
so in our Windows device which is the device that we always attack.
I'm going to run a command DARPA to list all the entries and the AARP table.
So each computer has an AARP table and that table associates IP addresses with MAC addresses so we can
see the IP address of the writer which is 10 2014 one is associated with the MAC address 52 54.
And it ends up in 35 0 0.
So this is the MAC address for the IP for the writer.
So the way that they are poisoning works like we discussed before is it works before because each request
is trusted and clients accept responses even if they didn't send the request.
So what the hacker does is he sends a response to the client telling them that they are the writer.
So the client will accept that if it was trusted and is going to accept the response even though it
didn't send the request then we'll send another response to the writer telling them that we are the
client.
So what's this is going to do it's going to modify the entries and the AARP tables and both and the
router and in the client and for the client it's going to contain the hackers MAC address and it's going
to associate that with the writers IP address.
So what's basically going to happen is it's going to modify the MAC address here and it's going to change
that to the attackers MAC address and instead of the writer's real MAC address.
So when that happened then the hacker will be in the middle of the connection and they'll be able to
read analyze and modify the packets because they're going to be flowing through the hacker device so
let's run they are poisoning normal they are people using attacks like we always do it and when I go
back here I'm going to execute the same commands I'm going to do any RPA again and note how with the
MAC address is going to be different.
So the MAC address for the router it used to be this one and when we write the command that the MAC
address changed to this one and this MAC address right here is the MAC address of the network card that
the attackers use.
So if I come here and just do an F config you'll see that this is the MAC address the same the same
MAC address that is displayed in here.
So this is the easiest and the simplest way to discover a are poisoning attacks.
It's not the hands yes way though because you're going to have to keep doing this command and keep comparing
the entries if you really wanted to check if you're being a IP poisoned.
So there is a tool called X R and it allows it does that automatically for you and it's available for
Linux and Windows.
So I already downloaded you can just Google X Arp and you can download it.
Very easy to download and install.
And I'm just going to run it.
I'm actually going to stop the attack first and then I'm going to want to now notice when you stop the
attack the IP address is going to go back to what it was so you can see that the MAC address of the
router is back to its default right value of the writer so I'm just gonna run X out now and you can
see that everything is good.
And you can see that the entries are very similar to what we did when we did a RPA.
So we have the IP addresses and the MAC addresses associated with it.
What the tool basically does.
It's just going to automatically monitor this and whenever something changes it's gonna know that something's
wrong is happening because each IP address should have a unique MAC address.
There should be no duplicates in the network.
So I'm gonna do another ARPU poisoning attack exactly like we did it before and when we come here you'll
see that X AAP is giving us a notification and telling us that something's happening.
It's telling us that the MAC address for the router which is the 10 2014 one IP has changed from this
to that and if we look here I'm going to click OK and if we look here we can see that the affected machines
are the writer my own machine right now and the attacker.
Sorry.
That's that's me.
And that's the attacker.
So basically we know that the machine at 10 2014 two or three is trying to do an eye are people using
attack because it's the one that the the rotors MAC address has changed too.
Therefore we know this is the attacker machine.
So this tool is really handy because it does the monitoring automatically for us and it will tell us
whenever someone is trying to a IP poisoned the network.