Right.
So let's talk about how we can detect IRP poisoning attacks.
First of all, let me show you the AARP tables.
So in our Windows device, which is the device that we always attack.
I'm going to run a command.
DARPA to list all the entries in the AARP table.
So each computer has an AARP table.
And that table associates IP addresses with Mac addresses so we can see the IP address of the writer,
which is 10 2014, one is associated with the Mac address, fifty to fifty four and it ends up in 35
zero zero.
So this is the Mac address for the IP, for the router.
So the way that they are IP poisoning works, like we discussed before, is it works before because
each request is trusted and clients accept responses even if they didn't send the request.
So what the hacker does is he sends a response to the client telling them that they are there after.
So the client will accept that it was trusted and is going to accept the response, even though it did
send the request.
Then we'll send another response to the writer telling them that we are the client.
So what's this is going to do?
It's going to modify the entries in the AARP tables and both.
And they're out there and in the client and for the client, it's going to contain the hackers Mac address
and it's going to associate that with the routers IP address.
So what's basically going to happen is it's going to modify the Mac address here and it's going to change
that to the attackers Mac address instead of the writer's real Mac address.
So once that happened, then the hacker will be in the middle of the connection and they'll be able
to read, analyze and modify the packets because they're going to be flowing through the hacker device.
So let's run the AARP poisoning, anormal AARP poisoning attack like we always do it.
And when I go back here, I'm going to execute the same command.
I'm going to do an RPA again and note how the Mac address is gonna be different.
So the Mac address for the router used to be this one.
And when we ran the command, then the Mac address changed to this one.
And this Mac address right here is the Mac address of the network card that the attackers used.
So if I come here and just do an F config.
You'll see that this is the Mac address, the same the same Mac address that is displayed in here.
So this is the easiest and the simplest way to discover a Arpey poisoning attacks.
It's not the handiest way, though, because you're going to have to keep doing this command and keep
comparing the entries.
If you really wanted to check if you're being IRP poisoned.
So there is a tool called X R and it allows it does that automatically for you.
And it's available for Linux and Windows.
So I already downloaded you can just Google X AAFP and you can download it.
Very easy to download and install.
And I'm just going to run it.
I'm actually going to stop the attack first.
And then I'm going to run to.
Now, notice, when you stop the attack, the IP address is going to go back to what it was.
So you can see that the Mac address of the router is back to its default, right value of the router,
so I'm just going to run X out now.
And you can see that everything is good.
And you can see that the entries are very similar to what we did when we did a RPA.
So we have the IP addresses and the Mac addresses associated with it, what the tool basically does.
It's just going to automatically monitor this.
And whenever something changes, it's going to know that something's wrong is happening because each
IP address should have a unique Mac address.
There should be no duplicates in the network.
So I'm gonna do another IRP poisoning attack exactly like we did before.
And when we come here, you'll see that X AAP is giving us a notification and telling us that something's
happening.
It's telling us that the Mac address for the router, which is detent 2014, one IP, has changed from
this to that.
And if we look here, I'm going to flick, OK, and if we look here, we can see that the effected machines
are the writer, my own machine right now.
And the attacker.
Sorry, that's that's me.
And that's the attacker.
So basically, we know that the machine at 2014 two or three is trying to do an IRP poisoning attack
because it's the one that the directors Mac address has changed to.
Therefore, we know this is the attacker machine.
So this tool is really handy because it does the monitoring automatically for us.
And it'll tell us whenever someone is trying to IRP poison the network.