Static ARP Entry

Hey guys, has anyone ever seen something like this :

I got Win98 box, and I want to make a static arp cache entry for some IP, so I deleted all the arp entries using arp -d option, verified it using arp -a (No ARP Entries Found), and then tried to add it using arp -a <IP> <MAC> option.

But no matter what MAC Address I put for that IP, when I view the entries using arp -a, I always see the same MAC Address for that IP (NOT the one i was inserting!), with static Type.

Any suggestions what is going on?

Hey guys, has anyone ever seen something like this :

I got Win98 box, and I want to make a static arp cache entry for some IP, so I deleted all the arp entries using arp -d option, verified it using arp -a (No ARP Entries Found), and then tried to add it using arp -a <IP> <MAC> option.

But no matter what MAC Address I put for that IP, when I view the entries using arp -a, I always see the same MAC Address for that IP (NOT the one i was inserting!), with static Type.

Any suggestions what is going on?

it seems i knew about The ARP .. but never try on win98.
and i found good site and perhaps it could help you.

Quote:

---

After loading the ARP files, you will need to perform a workstation

---

to read the overview you may click here .

i hope it can help you.

good luck mate.

:)

it seems i knew about The ARP .. but never try on win98.
and i found good site and perhaps it could help you.

Quote:

---

After loading the ARP files, you will need to perform a workstation

---

to read the overview you may click here .

i hope it can help you.

good luck mate.

:)

I can't really understand why do you want to use a different MAC-address than the one which is wrote to network adapters ROM. It seems that 'arp'-command reads the 'real' MAC-address from adapter and discards the one you've given.

As said, MAC-addresses are programmed into each physical hardware device, so IF you really need to change it, spoofing is a partial solution. However I don't know is it possible with 98 (newer MS OS's it is.).

[edit]
It seems that it's possible: http://www.klcconsulting.net/Change_MAC_w98.htm
[/edit]

I can't really understand why do you want to use a different MAC-address than the one which is wrote to network adapters ROM. It seems that 'arp'-command reads the 'real' MAC-address from adapter and discards the one you've given.

As said, MAC-addresses are programmed into each physical hardware device, so IF you really need to change it, spoofing is a partial solution. However I don't know is it possible with 98 (newer MS OS's it is.).

[edit]
It seems that it's possible: http://www.klcconsulting.net/Change_MAC_w98.htm
[/edit]

First of all: thanks, its nice, but its not exactly what i asked for.
It changes YOUR MAC address, and not an entry for some other computer...

Quote:

---

It seems that 'arp'-command reads the 'real' MAC-address from adapter and discards the one you've given

---

Cant i bypass that somehow?

Quote:

---

I can't really understand why do you want to use a different MAC-address

---

Im just researching my own home network. chapter is arp spoofing :)

First of all: thanks, its nice, but its not exactly what i asked for.
It changes YOUR MAC address, and not an entry for some other computer...

Quote:

---

It seems that 'arp'-command reads the 'real' MAC-address from adapter and discards the one you've given

---

Cant i bypass that somehow?

Quote:

---

I can't really understand why do you want to use a different MAC-address

---

Im just researching my own home network. chapter is arp spoofing :)

Quote:

---

then tried to add it using arp -a <IP> <MAC> option

---

It won't work because option -a only show current arp-settings and option -s ADDS one.

I also found a document about 98's arp-bug, read it here: http://www.securityfocus.com/[email protected]

G'luck :)

Quote:

---

then tried to add it using arp -a <IP> <MAC> option

---

It won't work because option -a only show current arp-settings and option -s ADDS one.

I also found a document about 98's arp-bug, read it here: http://www.securityfocus.com/[email protected]

G'luck :)

You right... I did use arp -s option.

Good Search! :)
Yeah I guess its that bug.... I hope I will be able to find a way to fix it... maybe installing the latest SP/Patches will help.

Thanks All!!

You right... I did use arp -s option.

Good Search! :)
Yeah I guess its that bug.... I hope I will be able to find a way to fix it... maybe installing the latest SP/Patches will help.

Thanks All!!

a static arp entry is used to define the MAC address of another host on the network. It has nothing to do with being able to choose your own MAC address because if you did that, your network connectivity would essentially be lost.

Perhaps you could read this:
www.sentryinformation.com/library/networking/ Non-blind_Session_Hijacking.doc

a static arp entry is used to define the MAC address of another host on the network. It has nothing to do with being able to choose your own MAC address because if you did that, your network connectivity would essentially be lost.

Perhaps you could read this:
www.sentryinformation.com/library/networking/ Non-blind_Session_Hijacking.doc

http://www.klcconsulting.net/Change_MAC_w2k.htm

This answer your question .

Changing your own MAC address , yes it 's possible .

In a switch Network , doing this might be tricky . My Cnet switch crash when it learns that there is a same MAC Address for 2 port . Some other Switch won't ( include my company Cisco 2950) .

I 've faked the Mac address and the IP address of the default-gateway, hence redirect all Internet-destined traffic to my computer. Sometime i do this to observe what my staffs often do when they 're online (in 2 or 3 minutes of course ) . One more thing , i have to write a small script pinging every host of the Network , to fool them i am the default gateway (exploit of ARP table and prevent the entry from timing out) .

What if some one in my firm do this ? i absolutely have no clue to answer this question .

Well, wel, well,
it seems that some guys around here does not understand what ARP aims to!

Quote:

---

It seems that 'arp'-command reads the 'real' MAC-address from adapter and discards the one you've given.

---

For your information, on a broadcast domain such as ethernet medium host needs to know about the remote host they want to communicate with. In an other word they have to resolve the distant MAC address.
Most application are using IP and ARP is aprotocol design to resolve the MAC address of an host you know the IP@.
A first packet is sent in a broadcast way (ARP request) this packet says "I am looking for the MAC address of PC with IP xxx ". )
Broadcast frames by pass the ethernet driver to the uper level stacks. There the ARP stack will respond if & only if the IP xxx is their own.
An ARP reply is sent back to the origine in unicast manner saying "I am the one, my MAC address is xxx".
Then the IPtoMAC table is fulfilled with the associated MAC & IP @ .
When you type arp -a you see the IPtoMAC table.

The MAC address is created to be a unique unchanging value directly burnt into your NIC card. I dont even see how changing your MAC address is possible. The MAC address is needed, tables and such are based on that MAC address, to change that address would create some problems. There may be a way of cloaking the MAC address. But ive not heard of a way to change it.

I will have to read up on what yuna_admirer has to offer, its completely new to me.

like rdev say,
$arp -s host mac

and...
if u wanna learn more about arp poison tricks, try ettercap at http://ettercap.sourceforge.net/ or dsniff at
http://naughty.monkey.org/~dugsong/dsniff/
Enjoy it!

groby

Quote:

---

brandon64_99 wrote:
I dont even see how changing your MAC address is possible.

---

Forging the MAC source address may be very helpful to an attacker. That's call ARP or MAC poisining.
I advise you to read a tut I wrote few month ago: hhttp://www.antionline.com/showthrea...hreadid=237836

As grobyccil wrote DSNIFF is a software of great interest for forging spoof MAC addresses. It's obvious that these type of attacks are restricted to the ethernet media where the attacker host is located, but the attack could bounce on a victim host thanks to bots/zombie. Therefore this threat had to be taken under consideration very seriously