VII. Detecting Systems in Promiscuous Mode in a Network Using PromqryUI

Scenario

With an ARP storm attack, an attacker collects the IP address and MAC address of the machines in a network for future attacks. An attacker can send ARP packets to attack a network. If an ARP packet with a forged gateway MAC address is pushed to the LAN, all communications within the LAN may fail. This attack uses all resources of both victim and non-victim computers.

As a network administrator, you must always diagnose the network traffic using a network analyzer and configure routers to prevent ARP flooding. Using a specific technique with a protocol analyzer you should be able to identify the cause of the broadcast storm and a method to resolve the storm. Identify susceptible points on the network and protect them before attackers discover and exploit the vulnerabilities, especially on ARP-enabled LAN systems, a protocol with known security loopholes that allow attackers to conduct various ARP attacks.

Attackers may also install network interfaces to run in promiscuous mode to capture all the packets that pass over a network. As an expert ethical hacker and penetration tester, you must be aware of the tools to detect network interfaces running in promiscuous mode as it might be a network sniffer. In this lab, you will learn to use the tool PromqryUI to detect such network interfaces running in promiscuous mode.

Lab Objectives

The objective of this lab to accomplish:

• To detect promiscuous systems in a network

Detecting Systems Running in Promiscuous Mode in a Network Using PromqryUI

Lab Analysis

In this lab, you have learnt how to detect promiscuous systems in a network. Analyze and document the results related to the lab exercise.