Results 1 to 7 of 7

Thread: udp and arp help

  1. February 3rd, 2004, 11:17 PM #1
    droffohcam03
    droffohcam03 is offline
    Member
    Join Date
    Jan 2003
    Posts
    47

    udp and arp help

    im running a packet sniffer on my network and every once and a while i notice a udp packet that comes out of my router and is going to the netmask. is this my router trying to refresh its arp cashe. if not what is it doing?

    by the way can someone please explain to me what arp poisoning is i know what it dose but i just dont understand how it works.

    thx
    Reply With Quote Reply With Quote
  2. February 3rd, 2004, 11:18 PM #2
    Cybr1d
    Cybr1d is offline
    HeadShot Master N1nja Cybr1d's Avatar
    Join Date
    Jul 2003
    Location
    Boston, MA
    Posts
    1,840
    here u go buddy:

    http://www.cigitallabs.com/resources.../arppoison.pdf

    http://www.watchguard.com/infocenter...ial/135324.asp
    Reply With Quote Reply With Quote
  3. February 4th, 2004, 04:50 PM #3
    el-half
    el-half is offline
    Senior Member
    Join Date
    Jun 2003
    Posts
    772
    ARP doesn't work over UDP or something so no packet you capture that is UDP or TCP is an ARP request/reply.
    The above sentences are produced by the propaganda and indoctrination of people manipulating my mind since 1987, hence, I cannot be held responsible for this post\'s content - me

    www.elhalf.com
    Reply With Quote Reply With Quote
  4. February 4th, 2004, 05:43 PM #4
    R0n1n
    R0n1n is offline
    Senior Member
    Join Date
    Oct 2002
    Posts
    314
    Can you dump the output of the sniffer on here for us to look at?
    Quis custodiet ipsos custodes
    Reply With Quote Reply With Quote
  5. February 4th, 2004, 06:13 PM #5
    Shrekkie
    Shrekkie is offline
    Trumpet-Eared Gentoo Freak
    Join Date
    Jan 2003
    Posts
    992
    If you wanna do decent sniffing, first learn the protocols so you 'll know what you're searching.
    No offence, but if you don't know for.ex. that arp is a datalink-layer protocol and udp a protocol over tcp/ip, meaning ip is layer 3 ( network layer )and tcp/udp layer 4 (transmission layer) , you have no business searching for arp-poisoning. (My layer references are regarding osi-model, tcp/ip - model is a lil different)

    If you understand above, you'll know el-half's answer is absolutely right ...

    Anyway here's your chance to actually learn anything ...

    http://www.protocols.com/pbook/tcpip1.htm
    Come and check out our wargame-site @ http://www.rootcontest.org
    We chat @ irc.smdc-network.org #lobby
    Reply With Quote Reply With Quote
  6. February 5th, 2004, 09:18 PM #6
    droffohcam03
    droffohcam03 is offline
    Member
    Join Date
    Jan 2003
    Posts
    47
    thx for the help with the arp poisoninbg and i fill learn more about protocals before doing anything else but any idea on what the udp packets are?
    Reply With Quote Reply With Quote
  7. February 5th, 2004, 10:27 PM #7
    ammo
    ammo is offline
    Senior Member
    Join Date
    Sep 2001
    Posts
    1,027
    What ports are the udp packets from/to?
    I'd bet they are 67/68: bootp/dhcp broadcasts, looking for an IP lease....

    Ammo
    Credit travels up, blame travels down -- The Boss
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules