Tjyylli

What is the difference between a "ranged attack" and a "ranged weapon attack"?

Nose gear failure in single prop aircraft: belly landing or nose-gear up landing?

Random body shuffle every night—can we still function?

Project Euler #1 in C++

what is the log of the PDF for a Normal Distribution?

Does silver oxide react with hydrogen sulfide?

Is it dangerous to install hacking tools on my private linux machine?

If Windows 7 doesn't support WSL, then what is "Subsystem for UNIX-based Applications"?

What initially awakened the Balrog?

Is there public access to the Meteor Crater in Arizona?

A proverb that is used to imply that you have unexpectedly faced a big problem

malloc in main() or malloc in another function: allocating memory for a struct and its members

Is openssl rand command cryptographically secure?

Relating to the President and obstruction, were Mueller's conclusions preordained?

Is there hard evidence that the grant peer review system performs significantly better than random?

Flight departed from the gate 5 min before scheduled departure time. Refund options

Tannaka duality for semisimple groups

Co-worker has annoying ringtone

Why is std::move not [[nodiscard]] in C++20?

Is multiple magic items in one inherently imbalanced?

In musical terms, what properties are varied by the human voice to produce different words / syllables?

New Order #6: Easter Egg

How does TikZ render an arc?

Why not use the yoke to control yaw, as well as pitch and roll?

Kali MITM results in TCP Retransmissions abound

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}

0

I want to test some of my more advanced switches/APs and whether they're effective at stopping ARP Spoofing, so first I'm practicing making it work.

I have Kali booting from USB, connected to the network over ethernet. The process so far has been:

echo 1 > /proc/sys/net/ipv4/ip_forward

dhclient eth0 # just to get an IP address

arpspoof -i eth0 -t 172.16.0.2 -r 172.16.0.1

172.16.0.2 is the device I want to attack and .1 is the router.

When I open wireshark and listen to what's happening, I get almost exclusively TCP retransmissions and the target computer becomes unable to do anything at all.

Before I used dhclient, I used ifconfig eth0 172.16.0.3 netmask 255.255.255.0 but this worked even worse... With that, the target computer couldn't do anything; when I used dhclient (to set the route for me), the target could at least ping the router, but couldn't ping 8.8.8.8 any more (or anything else online).

Also, this computer sometimes replies to the ICMP ping with redirect host(New Addr: ....) from my computer's IP address.

Why is this doing this? Why are the packets not being forwarded correctly? Why are there so many TCP retransmissions? Why is my computer telling it to talk to somebody else?

For a MITM attack, this sure isn't stealthy.

kali-linux arp

share|improve this question

asked 5 hours ago

iAdjunctiAdjunct

1,435917

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  If you are testing the switch, you really should be listening for the traffic on all ports of the switch. My best guess is that both your Kali and the intended destination are answering the ARP, the switch gets confused and transfers some packets to your Kali and some to the real destination, and hence the retransmissions. And yes, ICMP redirects are fun. ARP spoofing isn't that easy...
  
  – dirkt
  41 mins ago
  

  
  
  
  

add a comment | 

0

I want to test some of my more advanced switches/APs and whether they're effective at stopping ARP Spoofing, so first I'm practicing making it work.

I have Kali booting from USB, connected to the network over ethernet. The process so far has been:

echo 1 > /proc/sys/net/ipv4/ip_forward

dhclient eth0 # just to get an IP address

arpspoof -i eth0 -t 172.16.0.2 -r 172.16.0.1

172.16.0.2 is the device I want to attack and .1 is the router.

When I open wireshark and listen to what's happening, I get almost exclusively TCP retransmissions and the target computer becomes unable to do anything at all.

Before I used dhclient, I used ifconfig eth0 172.16.0.3 netmask 255.255.255.0 but this worked even worse... With that, the target computer couldn't do anything; when I used dhclient (to set the route for me), the target could at least ping the router, but couldn't ping 8.8.8.8 any more (or anything else online).

Also, this computer sometimes replies to the ICMP ping with redirect host(New Addr: ....) from my computer's IP address.

Why is this doing this? Why are the packets not being forwarded correctly? Why are there so many TCP retransmissions? Why is my computer telling it to talk to somebody else?

For a MITM attack, this sure isn't stealthy.

kali-linux arp

share|improve this question

asked 5 hours ago

iAdjunctiAdjunct

1,435917

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  If you are testing the switch, you really should be listening for the traffic on all ports of the switch. My best guess is that both your Kali and the intended destination are answering the ARP, the switch gets confused and transfers some packets to your Kali and some to the real destination, and hence the retransmissions. And yes, ICMP redirects are fun. ARP spoofing isn't that easy...
  
  – dirkt
  41 mins ago
  

  
  
  
  

add a comment | 

I want to test some of my more advanced switches/APs and whether they're effective at stopping ARP Spoofing, so first I'm practicing making it work.

I have Kali booting from USB, connected to the network over ethernet. The process so far has been:

echo 1 > /proc/sys/net/ipv4/ip_forward

dhclient eth0 # just to get an IP address

arpspoof -i eth0 -t 172.16.0.2 -r 172.16.0.1

172.16.0.2 is the device I want to attack and .1 is the router.

When I open wireshark and listen to what's happening, I get almost exclusively TCP retransmissions and the target computer becomes unable to do anything at all.

Before I used dhclient, I used ifconfig eth0 172.16.0.3 netmask 255.255.255.0 but this worked even worse... With that, the target computer couldn't do anything; when I used dhclient (to set the route for me), the target could at least ping the router, but couldn't ping 8.8.8.8 any more (or anything else online).

Also, this computer sometimes replies to the ICMP ping with redirect host(New Addr: ....) from my computer's IP address.

Why is this doing this? Why are the packets not being forwarded correctly? Why are there so many TCP retransmissions? Why is my computer telling it to talk to somebody else?

For a MITM attack, this sure isn't stealthy.

kali-linux arp

share|improve this question

asked 5 hours ago

iAdjunctiAdjunct

1,435917

echo 1 > /proc/sys/net/ipv4/ip_forward

dhclient eth0 # just to get an IP address

arpspoof -i eth0 -t 172.16.0.2 -r 172.16.0.1

share|improve this question

asked 5 hours ago

iAdjunctiAdjunct

1,435917

share|improve this question

asked 5 hours ago

iAdjunctiAdjunct

1,435917

asked 5 hours ago

iAdjunctiAdjunct

1,435917

asked 5 hours ago

iAdjunctiAdjunct

1,435917