Category: Networking

How attacker can launch man in the middle attack using ARP spoofing and what is ARP spoofing?
Attackers can attempt to launch an attack by sending gratuitous ARP – GARP replies. GARP reply messages are sent from some device in the network to other without the prior receiving of a request for sending a ARP reply. Is an ARP reply without cause. This reply without cause can tell network devices that the attacker’s MAC address corresponds to specific IP addresses that is actually IP address of some other device in the LAN.

Function of DHCP

On our networks all the different clients will usually obtain their IP address information automatically, using DHCP – Dynamic Host Configuration Protocol. This is faster and more precise than having their IP address information statically configured by manually entering the IP address, subnet mast and Default gateway into PC.

DHCP Attack

To dynamically obtain IP address information, a client makes a DHCP request. A DHCP server sends back a DHCP response in which includes information as an IP address, subnet mask, and default gateway. If an attacker puts and false DHCP server in our LAN network, the rogue DHCP server can respond to a client’s DHCP request. Even if the rogue DHCP server and the actual DHCP server both respond to the request of our PC, the PC will use the rogue DHCP server’s response if it reaches the PC faster than actual DHCP server.

More about DHCP and about DHCP attack here. Let’s se the mechanisms to mitigate the attacks or prevent them fully:

DHCP snooping