[pointandlaugh]

So I recently made an ARP poisoner script and tried to get my Windows desktop to forward packets through my laptop, but running Wireshark I couldn't see anything coming from the desktop. I checked the ARP cache on both machines and my script seemed to work fine, both were displaying what I expected and I seem to remember being satistfied the router was doing what I expected as well.

Are there any defensive techniques that would mitigate an attack like this? Either on the router or in the OS itself? And if I sustained the attack over, say, 12 to 24 hours, could I expect to see the packets start coming through my MITM box?

[realsunjester]

So I recently made an ARP poisoner script and tried to get my Windows desktop to forward packets through my laptop, but running Wireshark I couldn't see anything coming from the desktop. I checked the ARP cache on both machines and my script seemed to work fine, both were displaying what I expected and I seem to remember being satistfied the router was doing what I expected as well.

Are there any defensive techniques that would mitigate an attack like this? Either on the router or in the OS itself? And if I sustained the attack over, say, 12 to 24 hours, could I expect to see the packets start coming through my MITM box?

routers can be made to only accept requests from certain macs that match certain IP's. is this a virtual environment or are you using a computer on your lan? if the cache was changed then you should immediately see a different ip associated with the mMAC

[pointandlaugh]

routers can be made to only accept requests from certain macs that match certain IP's. is this a virtual environment or are you using a computer on your lan? if the cache was changed then you should immediately see a different ip associated with the mMAC

This was my physical LAN at home. I definitely saw it update, my desktop had my laptop resolving as the gateway IP and I think I sent a request onto the wire asking where the desktop was and got my laptop's MAC as a reply from the router. I'll have to rerun it and dump results here when I get home, I'd like to figure out what I'm doing wrong

[bandors]

Most modern routers have fine grain controls built in to limit the amount of arp requests a network can generate.