OK.
So now let's see how we can use wire shark to discover suspicious activities in our network and before
I do anything I'm gonna go to the preferences
and I'm gonna go to protocols AARP
and I'm going to enable the option to detect AARP requests.
Terms what this will do it will actually discover if anybody is trying to discover all the devices or
on the network and it's gonna give me a notification.
So I'm gonna click on OK and I'm gonna start my captcha
now I'm gonna go to my candy machine and I'm going to use Net this cover so I'm not going to do A R
P poisoning.
I'm only going to do a try to discover all the connected devices to my network.
So we're using exactly the same command that we used before the Discover interface and the range to
hit enter and we can see that net discover finished it discovered all the devices that we have so if
we come here even before we look at the output of the notifications let's just look at the packets that
have been generated you can see that there is a device here.
This source is broadcasting.
So basically it doesn't have a destination.
It's asking all the other devices and the network and it's inquiring about each possible IP.
So it's basically asking who has this IP until the 67 IP.
And then it's asking Who has the two for one IP tell the 67 who has the two told the 67 and it's doing
this for every possible IP.
So it's basically a chicken if any possible IP and the range exists.
And it's asking to return to the response to the IP adds 10 20 40 67.
So from this we can deduce that someone's trying to discover all the connected devices and that someone
is at 10 20 40 67.
Now if you go on the analyze and expert information you'll see that we detected an IP packet storm.
So basically it means that there was a single device sending a very large number of IP packets.
So they're probably trying to discover connected devices or try and discover connected ports.
So it's telling us that this person is trying to do something suspicious.
Now let's go and I'm going to do a.
They are people using attack and we'll see if we can get any notifications or warnings and while shark.
Now I'm gonna go to analyze and expert info again.
And if we look we'll see we have a warning here.
And the warning is telling us that there is a duplicate IP address configured.
So again this is telling us that the IP address of the router had two different MAC addresses what this
means.
Basically it means that someone was tampering with this and tampering with our IP table trying to place
themselves in the middle.
Use it.
An AARP poisoning attack.
Now we've seen a number of methods to detect AARP poisoning.
Let's discuss how we can prevent it or protect ourselves from it.
Now I'm just going to run an RPA and we're going to look at our table.
There is switches that will monitor this for you as well and they'll notify you or even prevent AARP
poisoning attacks.
Another way to do that is if you look at here if you look at your router you'll see that this entry
in the table is dynamic.
So the type of this entry is dynamic what that means it basically this can change.
It's the system allows this value to be changed.
You can see right here you have static values which basically means the system will never allow these
values to change.
So you can use static AARP tables which basically means that you'll have to configure each IP address.
So you have to actually configure your IP table and map each IP address to the MAC address to the relevant
MAC address.
But once you do that even if someone tries to send a response to your computer try to change it the
system will refuse to change anything because you configured your IP table to be static.
The only problem with that is every time you connect to a network and every time there is a new device
connecting to your network you'll have to manually configured that device to you to work with your network.
So it's not a very useful solution if you're in a big company or if you're in a big firm but maybe in
a small house or in a small company then this would be a really good solution to prevent AARP poisoning
attacks because everything is going to be static.
You're going to have to set it up manually.
But once someone tries to do an AARP poisoning attack even if their attack is successful and they use
the best tools they can your table is set up in a way that it's not it's it's fixed.
It can't be changed.
So so the system will always refuse to change the values of the MAC addresses which will basically mean
a are people poisoning attacks will never work against you.