Instructor: Okay, so now let's see
how we can use Wireshark,
to discover suspicious activities in our network.
And before I do anything I'm gonna go to the preferences,
and I'm gonna go to protocols,
ARP,
and I'm gonna enable the option
to detect ARP request storms.
What this will do it will actually discover,
if anybody is trying to discover
all the devices on the network
and it's gonna give me a notification.
So I'm gonna click on okay,
and I'm gonna start my capture,
and now I'm gonna go to my Kali machine,
and I'm gonna use netdiscover.
So I'm not gonna do ARP poisoning.
I'm only gonna do,
or try to discover all the connected devices to my network.
So we are using we're using exactly the same command
that we used before, netdiscover, interface and the range.
I'm gonna hit enter,
and we can see that netdiscover finished.
It discovered all the devices that we have.
So if we come here,
even before we look at the output of the notifications,
let's just look at the packets that have been generated.
You can see that there is a device here.
This source, is broadcasting,
so basically it doesn't have a destination.
It's asking all the other devices in the network,
and it's inquiring about each possible IP.
So it's basically asking who has this IP?
And tell the 67 IP.
And then it's asking who has the 241 IP?
Tell the 67.
Who has the 251?
Tell the 67,
and it's doing this for every possible IP.
So it's basically
checking if any possible IP in the range exists
and it's asking to return the response
to the IP at 10.20.40.67.
So from this we can deduce that
someone is trying to discover all the connected devices
and that someone is at 10.20.40.67.
Now if we go on the analyze and expert information
you will see that we detected an ARP packet storm.
So basically it means that there was a single device
sending a very large number of ARP packets.
So they are probably trying to discover connected devices
or trying to discover connected ports.
So it's telling us that this person
is trying to do something suspicious.
Now let's go and I'm gonna do a ARP poisoning attack
and we'll see if we can get any notifications
or warnings in Wireshark.
Now I'm gonna go to analyze and expert info again
and if we look we'll see that we have a warning here
and the warning is telling us
that there is a duplicate IP address configured.
So again this is telling us
that the IP address of the router
had two different MAC address.
What this means basically
it means that someone was tampering with this
and tampering with our ARP table,
trying to place themselves in the middle
using an ARP poisoning attack.
Now we've seen a number of methods to detect ARP poisoning.
Let's discuss how we can prevent it,
or protect ourselves from it.
Now I'm just gonna run an ARPA
and we're gonna look at our table.
There is switches that will monitor this for you as well
and they will notify you
or even prevent ARP poisoning attacks.
Another way to do that is if you look at here.
If you look at your router,
you'll see that this entry in the table is dynamic.
So the type of this entry is dynamic.
What that means, it basically this can't change.
It's the system allows this value to be changed.
You can see right here you have static values
which basically means, the system will never allow
these values to change.
So you can use static ARP tables,
which basically means that you'll have to configure
each IP address.
So you have to actually configure your ARP table
and map each IP address to the MAC address,
to the relevant MAC address.
But once you do that,
even if someone tries to send a response
to your computer tryna to change it,
the system will refuse to change anything
because you configured your ARP table to be static.
The only problem with that, is every time you connect
to a network and every time there is a new device
connecting to your network,
you'll have to manually configure that device
to work with your network.
So it's not a very useful solution
if you're in a big company or if you're in a big firm.
But maybe in a small house, or in a small company
then this would be a really good solution
to prevent ARP poisoning attacks
because everything is gonna be static,
you're gonna have to set it up manually,
but when someone tries to do an ARP poisoning attack
even if their attack is successful
and they use the best tools they can,
your table is set up in a way that it's fixed.
It can't be changed.
So the system will always refuse
to change the values of the MAC addresses
which will basically mean ARP poisoning attacks
will never work against you.