III. Sniffing a Network Using the WinArpAttacker Tool

Scenario

You have already learned in the previous lab that you can conceal your identity by spoofing the MAC address. An attacker too can alter his or her MAC address and attempt to evade network intrusion detection systems, bypass access control lists, and impersonate as an authenticated user and can continue to communicate within the network when the authenticated user goes offline. Attackers can also push MAC flooding to compromise the security of network switches.

As an administrator, it is very important for you to detect odd MAC addresses on the network; you must have sound knowledge of footprinting, network protocols and their topology, TCP and UDP services, routing tables, remote access (SSH or VPN), and authentication mechanisms. You can enable port security on the switch to specify one or more MAC addresses for each port. Another way to avoid attacker sniffing on your network is by using static ARP entries. In this lab, you will learn to run the tool WinArpAttacker to sniff a network and prevent it from attacks.

Lab Objectives

The objectives of this lab are to:

• Scan, Detect, Protect, and Attack computers on local area networks (LANs):

• Scan and show the active hosts on the LAN within a very short time period of 2-3 seconds

• Save and load computer list files, and save the LAN regularly for a new computer list

• Update the computer list in passive mode using sniffing technology

• Freely provide information regarding the type of operating systems they employ?

• Discover the kind of firewall, wireless access point and remote access

• Discover any published information on the topology of the network

• Discover if the site is seeking help for IT positions that could give information regarding the network services provided by the organization

• Identify actual users and discover if they give out too much personal information, which could be used for social engineering purposes

In this lab you have learnt how to:

• Scan, Detect, Protect, and Attack computers on local area networks (LANs):

• Scan and show the active hosts on the LAN within a very short time period of 2-3 seconds

• Save and load computer list files, and save the LAN regularly for a new computer list

• Update the computer list in passive mode using sniffing technology

• Freely provide information regarding the type of operating systems they employ?

• Discover the kind of firewall, wireless access point and remote access

• Discover any published information on the topology of the network

• Discover if the site is seeking help for IT positions that could give information regarding the network services provided by the organization

• Identify actual users and discover if they give out too much personal information, which could be used for social engineering purposes

Lab Analysis

Analyze and document the scanned, attacked IP addresses discovered in the lab.