Discovering MAC- and ARP-based attacks
There are various types of layer-2 MAC-based attacks and layer-2/3 ARP attacks that can be easily discovered by Wireshark. These attacks are usually caused by scanners (described in the next recipe) and man-in-the-middle attacks (described in the Analyzing connectivity problems with ARP recipe in Chapter 8, ARP and IP Analysis). In this recipe, we will see some typical attack patterns and their meanings.
Getting ready
When viewing too many ARP requests on a network or when seeing non-standard MAC addresses in the network, connect Wireshark with port mirror to their source and start the capture.
How to do it...
To look for ARP/MAC-based attacks, follow these steps:
- Connect Wireshark to any port on the network. ...
Get Network Analysis Using Wireshark Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
