arp replay gateway

[Axl]

t-2 gateway 89.212.0.1 me je arp replayu in mac spoofu
Zakaj sploh to delajo?


0000: 00 30 4F 23 6E 4B 00 90 : 1A A0 47 F3 08 06 00 01 | .0O#nK....G.....
0010: 08 00 06 04 00 02 00 90 : 1A A0 47 F3 59 D4 00 01 | ..........G.Y...
0020: 00 30 4F 23 6E 4B 59 D4 : 37 3F 00 00 00 00 00 00 | .0O#nKY.7?......
0030: 00 00 00 00 00 00 00 00 : 00 00 00 00 | ............



Unsolicited incoming ARP reply detected, this is a kind of MAC spoofing that may consequently do harm to your computer.

Packet data is shown in the right window.


% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Note: the default output of the RIPE Whois server
% is changed. Your tools may need to be adjusted. See
% http://www.ripe.net/db/news/abuse-propo ... 50331.html
% for more details.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '89.212.0.0 - 89.212.0.255'

inetnum: 89.212.0.0 - 89.212.0.255
netname: SI-T-2
descr: T-2 Access Network
country: SI
admin-c: TRT3-RIPE
tech-c: TRT3-RIPE
status: ASSIGNED PA
remarks: INFRA-AW
mnt-by: MNT-T-2
source: RIPE # Filtered

role: T-2 Ripe Team
address: T-2 d.o.o.
Streliska cesta 150
2000 Maribor
Slovenia
e-mail: noc@t-2.net
admin-c: PP3532-RIPE
tech-c: PP3532-RIPE
tech-c: DB3688-RIPE
nic-hdl: TRT3-RIPE
mnt-by: MNT-T-2
source: RIPE # Filtered

% Information related to '89.212.0.0/18AS34779'

route: 89.212.0.0/18
descr: T-2 d.o.o.
Provider Aggregated Block
origin: AS34779
mnt-by: MNT-T-2
source: RIPE # Filtered

[Anubis]

Na mrezni za TV "signal"?

[gulikoza]

T-2 mreža se obnaša kot en velik LAN (zato tudi maska 255.255.192.0). Ker to dejansko ni (vmes so routerji...), se efekt doseže z manipulacijo arp replayev. Katerokoli mašino pingaš na T-2 in je v istem subnetu (pri nas ki smo na 84.255 je to še bolj opazno), boš za reply dobil isto MAC adreso čeprav je to le adresa prvega routerja ki ta paket potem posreduje naprej.
Program te na to opozarja, ker lahko nekdo ki je na isti mreži s to taktiko pregleduje tvoje pakete (ti pošlje sebe kot destination, potem pa sam posreduje naprej) in eventuelno dobi tvoje passworde. Ker gre promet tako ali tako čez T-2 se nimaš tu kaj za sekirat (uporabljaj ssh! )