Arp Attack

[black_death]

How an arp attack is traced?

[prodikal]

if you have the IP address you could use a proggrame called neotrace and there is a whois right here at antionline under tools and toys *there is also a IP locator* and you could go over to www.samspade.com and there is yet another whois etc there are many ways to trace an IP address these are to name but a few i assume you do have the IP address ? hope this can help you some

[Common_Exploit]

People trace other people performing attacks many ways. One, would be by taking the IP Address and by using a whois utility to find out the ISP. From there, they can do many things such as complain to the Abuse dept. and say they were performing and ARP attack. Also, they can use a tool such as neoTrace, to trace their exact to close location and work from there.

[alanmott]

Are we talking about the same thing here?

Tracert, Traceroute and Neotrace work on addressing an IP packet to the address of the host you're trying trace, but with the TTL bit set to 1. The packet will be dropped by the first router the packet encounters. However the router will then return to you an ICMP packet saying that this has happened. This ICMP packet will have the IP address of the router that dropped the packet in its SOURCE field, thus letting you know the IP address of the first router between you and the host you're trying to trace. The program then sends out another packet addressed to the host, this time with the TTL bit set to 2. This packet will be passed on by the first router, but dropped in the same way by the second router. Thus you will be informed of the IP address of the second router in the chain. This process is repeated, with the TTL bit being increased in value everytime a packet is sent, until a packet is received from the actual host you're trying to trace. Thus you build up a picture of the route IP packets will take between you and the remote host.

The Address Resolution Protocol (ARP), however works on sending a broadcast packet on a LAN requesting the MAC address of a host whose IP address you already know. This allows a PC to determine how to contact another PC on the network when the IP address is known but the MAC address is unknown.

Which of the above two scenarios is it you need further information on?

[nebulus200]

I think there is a little bit of confusion here. Each network device is assigned a 48-bit number by the manufacturer and is used on the datalink layer by networking devices on the same logical network to communicate directly (Layer 2 versus Layer 3 of the OSI model). Since it operates on its on layer of the model, it is roughly independent of IP and therefore that is not a very reliable way to track an alleged ARP attack.

If you would like more help tracking down such an attack, it would be helpful for you to list what kind of an attack you think you saw and what detected it. With that being said, I would recommend taking a look at your network's routers/switches and tracking the MAC address of the computer/device you believe to be the source of the problem. Every switch will have a MAC address associated with a port on it (this is how it knows where to send packets) and assuming you are not using 'dumb' or 'noncofigurable' switches, you should be able to determine what device is the source of the problem.

Good luck,

Nebulus