Male Instructor: Right, so let's talk about
how we can detect ARP poisoning attacks.
First of all, let me show you the ARP tables.
So, in our Windows device,
which is the device that we always attack,
I'm gonna run a command, arp-a,
to list all the entries in the ARP table.
So each computer has an ARP table
and that table associates IP addresses with Mac addresses.
So we can see the IP address of the router,
which is 10. 20. 14. 1,
is associated with the Mac address, 52-54,
and it ends up in 35-00.
So this is the Mac address for the IP, for the router.
So the way that ARP poisoning works like we discussed before
is it works because each request is trusted
and clients accept responses
even if they didn't send the request.
So what the hacker does is he sends a response
to the client telling them that they are the router.
So the client will accept that, it was trusted.
And it's going to accept the response,
even though it didn't send the request.
Then we'll send another response to the router
telling them that we are the client.
So what's this is going to do, it's going to modify
the entries in the ARP tables in both,
in the router and in the client,
and for the client it's going to contain
the hacker's Mac address and it's going to associate
that with the router's IP address.
So what's basically going to happen is
it's going to modify the Mac address here,
and it's going to change that to the attacker's Mac address.
And instead of the router's real Mac address.
So once that happened, then the hacker will be
in the middle of the connection,
and they'll be able to read, analyze, and modify the packets
because they're going to be flowing
through the hacker device.
So let's run the ARP poisoning.
A normal ARP poisoning attack like we always do it.
And when I go back here,
I'm going to execute the same command.
So I'm going to do an arp-a again.
And note how the Mac address is going to be different.
So the Mac address for the router, it used to be this one.
And when we ran the command,
the Mac address changed to this one.
And this Mac address right here
is the Mac address of the network card
that the attacker is using.
So if I come here and just do an ifconfig,
you'll see that this is the Mac address,
the same Mac address that is displayed in here.
So this is the easiest and the simplest way
to discover ARP poisoning attacks.
It's not the handiest way though,
because you're going to have to keep doing this command
and keep comparing the entries
if you really wanted to check if you're being ARP poisoned.
So there's a tool called XRP
and it does that automatically for you
and it's available for Linux and Windows.
So I already downloaded.
You can just Google XRP and you can download it.
Very easy to download and install,
and I'm just going to run it.
I'm actually going to stop the attack first,
and then I'm going to run the tool.
Now notice when you stop the attack,
the IP address is going to go back to what it was.
So you can see that the Mac address of the router
is back to its default right value of the router.
So I'm just going to run XRP now
and you can see that everything is good.
And you can see that the entries are very similar
to what we did when we did arp-a.
So we have the IP addresses
and the Mac addresses associated with it.
What the tool basically does,
it's just going to automatically monitor this.
And whenever something changes, it's going to know
that something's wrong is happening
because each IP address should have a unique Mac address.
There should be no duplicates in the network.
So I'm going to do another ARP poisoning attack
exactly like we did it before.
And when we come here you'll see
that XRP is giving us a notification
and telling us that something's happening.
It's telling us that the Mac address for the router,
which is the 10. 20. 14. 1. IP
has changed from this to that.
And if we look here, I'm going to click okay,
and if we look here, we can see that the effected machines
are the router, my own machine right now, and the attacker.
Sorry, that's me and that's the attacker.
So basically we know that the machine at 10. 20. 14. 203
is trying to do an ARP poisoning attack.
Because it's the one
that the router's Mac address has changed to.
Therefore, we know this is the attacker machine.
So this tool is really handy
because it does the monitoring automatically for us
and it'll tell us whenever someone
is trying to ARP poisoned the network.