Instructor: Okay, so now let's see 2 2
how we can use Wireshark, 3 3
to discover suspicious activities in our network. 4 4
And before I do anything I'm gonna go to the preferences, 5 5
and I'm gonna go to protocols, 6 6
ARP, 7 7
and I'm gonna enable the option 8 8
to detect ARP request storms. 9 9
What this will do it will actually discover, 10 10
if anybody is trying to discover 11 11
all the devices on the network 12 12
and it's gonna give me a notification. 13 13
So I'm gonna click on okay, 14 14
and I'm gonna start my capture, 15 15
and now I'm gonna go to my Kali machine, 16 16
and I'm gonna use netdiscover. 17 17
So I'm not gonna do ARP poisoning. 18 18
I'm only gonna do, 19 19
or try to discover all the connected devices to my network. 20 20
So we are using we're using exactly the same command 21 21
that we used before, netdiscover, interface and the range. 22 22
I'm gonna hit enter, 23 23
and we can see that netdiscover finished. 24 24
It discovered all the devices that we have. 25 25
So if we come here, 26 26
even before we look at the output of the notifications, 27 27
let's just look at the packets that have been generated. 28 28
You can see that there is a device here. 29 29
This source, is broadcasting, 30 30
so basically it doesn't have a destination. 31 31
It's asking all the other devices in the network, 32 32
and it's inquiring about each possible IP. 33 33
So it's basically asking who has this IP? 34 34
And tell the 67 IP. 35 35
And then it's asking who has the 241 IP? 36 36
Tell the 67. 37 37
Who has the 251? 38 38
Tell the 67, 39 39
and it's doing this for every possible IP. 40 40
So it's basically 41 41
checking if any possible IP in the range exists 42 42
and it's asking to return the response 43 43
to the IP at 10.20.40.67. 44 44
So from this we can deduce that 45 45
someone is trying to discover all the connected devices 46 46
and that someone is at 10.20.40.67. 47 47
Now if we go on the analyze and expert information 48 48
you will see that we detected an ARP packet storm. 49 49
So basically it means that there was a single device 50 50
sending a very large number of ARP packets. 51 51
So they are probably trying to discover connected devices 52 52
or trying to discover connected ports. 53 53
So it's telling us that this person 54 54
is trying to do something suspicious. 55 55
Now let's go and I'm gonna do a ARP poisoning attack 56 56
and we'll see if we can get any notifications 57 57
or warnings in Wireshark. 58 58
Now I'm gonna go to analyze and expert info again 59 59
and if we look we'll see that we have a warning here 60 60
and the warning is telling us 61 61
that there is a duplicate IP address configured. 62 62
So again this is telling us 63 63
that the IP address of the router 64 64
had two different MAC address. 65 65
What this means basically 66 66
it means that someone was tampering with this 67 67
and tampering with our ARP table, 68 68
trying to place themselves in the middle 69 69
using an ARP poisoning attack. 70 70
Now we've seen a number of methods to detect ARP poisoning. 71 71
Let's discuss how we can prevent it, 72 72
or protect ourselves from it. 73 73
Now I'm just gonna run an ARPA 74 74
and we're gonna look at our table. 75 75
There is switches that will monitor this for you as well 76 76
and they will notify you 77 77
or even prevent ARP poisoning attacks. 78 78
Another way to do that is if you look at here. 79 79
If you look at your router, 80 80
you'll see that this entry in the table is dynamic. 81 81
So the type of this entry is dynamic. 82 82
What that means, it basically this can't change. 83 83
It's the system allows this value to be changed. 84 84
You can see right here you have static values 85 85
which basically means, the system will never allow 86 86
these values to change. 87 87
So you can use static ARP tables, 88 88
which basically means that you'll have to configure 89 89
each IP address. 90 90
So you have to actually configure your ARP table 91 91
and map each IP address to the MAC address, 92 92
to the relevant MAC address. 93 93
But once you do that, 94 94
even if someone tries to send a response 95 95
to your computer tryna to change it, 96 96
the system will refuse to change anything 97 97
because you configured your ARP table to be static. 98 98
The only problem with that, is every time you connect 99 99
to a network and every time there is a new device 100 100
connecting to your network, 101 101
you'll have to manually configure that device 102 102
to work with your network. 103 103
So it's not a very useful solution 104 104
if you're in a big company or if you're in a big firm. 105 105
But maybe in a small house, or in a small company 106 106
then this would be a really good solution 107 107
to prevent ARP poisoning attacks 108 108
because everything is gonna be static, 109 109
you're gonna have to set it up manually, 110 110
but when someone tries to do an ARP poisoning attack 111 111
even if their attack is successful 112 112
and they use the best tools they can, 113 113
your table is set up in a way that it's fixed. 114 114
It can't be changed. 115 115
So the system will always refuse 116 116
to change the values of the MAC addresses 117 117
which will basically mean ARP poisoning attacks 118 118
will never work against you.