Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I thought arpspoof GATEWAY_IP -t VICTIM_IP can be prevented by add a static arp entry on victim side, i.e. arp -s GATEWAY_IP GATEWAY_MAC

I read, but i still wondering when bad guy do:

macchanger -m GATEWAY_MAC eth0

Is it able to bypass static arp entry protection? What actually would happen underground? Any documentation/resources have explaine this situation?

share|improve this question

closed as off-topic by TomTom, mdpc, Ward, Jenny D, TheCleaner Feb 26 '14 at 19:23

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – mdpc, Ward, Jenny D, TheCleaner
If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted

It will depend, in part, on the networking devices in use. A MAC address is supposed to be guaranteed globally unique. (Lots of assumptions made here.) Most likely, the switch would flip/flop back and forth between the two ports every 15s (the minimum time most switches appear to require before updating a forwarding database entry.).

I have no idea what you mean by, "What actually would happen underground?"

What the bad guy generally wants to do instead, is win the ARP race. This is done, usually, with lots of gratuitous ARP broadcasts and, simply, trying to answer the client's ARP request first.

As far as documentation, the attack is called ARP spoofing. If anything, read up about dug song's dsniff tool.

Good Luck.

[Updated to address the comment.] No, setting a static arp entry on the client would not protect from or prevent someone using macchanger as you described. If an attacker on your LAN were to use macchanger as you described, it would create for a situation where two stations on your LAN have the same MAC address.

However, if you have a managed switch - meaning, a switch you can log in to and configure. It almost certainly will support static forwarding entries. If you were to configure the gateway's mac address statically on the gateway's switch port, you would prevent an attacker from impersonating the gateway on your network. This is not the same as using arp -s.

share|improve this answer
Thanks for reply, but i wondering static arp entry, i.e. "arp -s GATEWAY_IP GATEWAY_MAC" defense can be bypass by someone else change his mac addr to gateway mac addr, .i.e. "macchanger -m GATEWAY_MAC eth0"? – 林果皞 Feb 24 '14 at 9:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.