MAC spoofing and packet sniffing?

If I use a packet sniffer to watch my network (its how I found that trojan on my other box yesterday) it listens on my ip, meaning I can see whats going on on my laptops connections, but id like to check my other two boxes.

Just putting the packet sniff on my other two boxes would be the easy option but for some reason the sniffer works with the pcmcia card but not the usb ones :s Also because im just lazy...

So as a wonder.. If I could spoof my ip and/or mac as the same as my router, could I watch the connections to my other machines aswell? Or even if I could spoof the same ip/mac as the boxes one at a time?

No need to spoof anything.. Use a hub instead of a switch to connect all your computers and put your NIC in promisquous mode..

Its a wireless router

Can anyone suggest a good packet sniffer that has promisquous mode? Airsnort seems to but it isn't very detailed and there is no filters or anything really...

Ethereal works perfectly well on a wireless network assuming WinPCap can use the wireless card which it usually seems to.

Ethereal works fine



Thanks
now to check these other boxes... Im really considering just completley stopping using windows on all of them

Why?

Windows does everything by itself but I keep ending up with problems like the one I had there, and spending more time on linux will help me learn

Quote:

---

Windows does everything by itself but I keep ending up with problems like the one I had there, and spending more time on linux will help me learn

---

Errrr.... Wrong..... It will help you learn a different OS...

Windows does do everything by itself.... But you do have a remarkable amount of control _if_ you want to have it and want to learn how.....

What's the difference?

I completely support switching over to Linux, in the interest of knowledge, experience, whatever...


But Windows is a good OS. And it really deserves a fair chance. Remember, it's still the industry standard... for the most part.

I agree with Tiger on this one...

Just remember that to secure your network, you have to know exactly how each OS you're using is communicating so that you can either turn it off, secure it, or watch it for intrusion:

MS Windows out of the box for example, may have NetBios, NetBEUI, IPX/SPX, and IP all listening to the network and sending out packets that anounce their presence. IP is the most likely candidate for intrusion.

For UNIX, IP is the lifeblood of UNIX-like OSs, available and intricately tied to almost
every function of the OS.
Rather than disabling networking, you'll more likely want to trim any unnecessary services and secure the system as well as you can.

Pay attention to the networking protocols in use by the Box's OSs and other networking devices you install. You'll want to disable any protocols you don't need and set up the proper monitoring and detection systems for the protocols you leave running.

:)

Uh, Tiger Shark and d0pp kind of summed it up.

I will say it a little less diplomatic:
If you can't handle Windows, use your computer as a door stop, you will get more use out of it.

Yes, M$ has problems. Most can be mitigated by proper administration.

And there in lies the quandary: How do you learn to administer an OS without understanding what it is doing, especially since M$ tries to do it for you without doing it properly from the start?

READ!
Everything you can.
M$ actually helps you. They provide a wealth of knowledgebase articles to study.

“ Google” for answers.

Come here to AO and search through the archives, ask questions if you can't find an answer.

Am I saying that Linux isn't a great OS? ........ No.

Am I saying you can't learn from Linux? .......... No.

What I am saying is that if you can't secure a M$ system, then installing Linux and expecting it to secure itself is futile at best.

Linux, at least in the early days, made you learn how to secure it, and run it for that matter.
Now pretty much anybody with a little computer savvy can install and run Linux. Just because fewer exploits are written for Linux at this time doesn't mean you are safe if you run it. That will change, before you know it.

And as d0pp said, M$ is the industry standard. If you expect a job somewhere, you better know M$. But if you want to learn something else, Linux can still be a great teacher.

Go to Linux for the right reasons.

MOOD: Drunk and Content. Just finished a GREAT Dominican, just got through teaching ( while learning and getting drunk together ) an old Linux guru and friend how to administer LVM on Linux, all while listening to a great CD, Big Band Christmas ( the Peter Jacobs Orchestra )
Life is Good, despite the curves it throughs.

Whoa. This topic has gone errr off-topic. For the record there are ways to "sniff" traffic going on on a router or switch. I've read about ARP poisioning which you could use to monitor traffic going on between specific computers or to the router. That way wouldn't be really realistic because of the hardware resources required. Another option is to use a proxy server on your network for all of your workstations.

On the side topic: I got the current job I have right now because I knew Linux.

Hope I kind of helped.

rasem

Rasem:

Keep reading.... Maybe you'll learn something in your browsings.... 'Cos you don't seem to understand the principle you are talking about right now....

What hardware requirements do you need to ARP spoof? :rolleyes:

Tiger Shark,

I would like to start by conceding to your superior skills.

I went back and re-read the section on MAC-address spoofing as you suggested. Would it be accurate to say that you could have multiple interceptions occurring through the same machine at the same time using a single NIC?

I'd appreciate your clarification.

rasem

Yes, that is what promiscuous mode means.


It accepts every packet it sees, not just those packets bound for whatever IP the NIC has.


The key is making every packet come to the NIC. That is where either a hub, or an ARP attack comes into play.

The hub will not direct packets to the correct NIC, every NIC sees every packet. And the ARP poisoning will convince the other machines that your computer is a gateway of sorts.

Gee - lots of posts, but I want to make sure that I'm fully understanding your answer, d0pp. I understand that that mode will accept all packets, however in the scenario we're doing this with a switch or router, so even if it is in promiscuous, it won't receive those packets unless it is actively either legitimately receiving packets or intercepting, by receiving the packets intended for another machine and then forwarding to the true target. The reason obviously being because the information is not being broadcast to all ports. What I am questioning is if you can actively receive intercepted packets by ARP poisoning from multiple machines. Writing it out, from my limited understanding, it seems plausible, but initially I had hastily assumed you'd required multiple NICs. If that is the case, I apologize.

rasem

If you are trying to capture packets from a whole switched network rather than an individual machine a better attack to try is an ARP flood. When you ARP flood a switch, (send packets claiming to be from multiple hosts that already exist out on the local network), you will either fill the switches ARP tables up or confuse the switch by having so many multiple entries that the switch will fail over to being a hub which broadcasts all packets on all ports.

ARP spoofing, by it's name, is better suited to use against an individual host.

A good site to check out on sniffing connections is www.remote-exploit.org they have a bootable cd you can even use. The video tutorials are a bit dull but will explain things in an easy way.

Check google for "Man in the middle" attacks, Although I use the term "Attack" this is another great way to check if any info is being sent from a computer, You will need two nic cards or at least two network connections (wired,wireless).

As the original topic requested, if you want to sniff a wireless network what you're more concerned with is having a WiFi card and driver that supports RFMon mode. This means that the actual card received all signals instead of those intended for it. The promiscuous mode only deals with the packets once they get to the OS.

Well, I'm not 100% certain about this wireless setup you have, but i know that if you plug a switch into your router, then plug all your hosts into that, you can spoof yourself as the gateway, and the all traffic will route through you, kinda like man in the middle attack. But really i dont know much else other than.