Discovering MAC-based and ARP-based attacks
There are various types of layer 2 MAC-based attacks and layer 2/3 ARP-based attacks that can be easily discovered by Wireshark. These attacks are usually caused by scanners (described in the next recipe) and man-in-the-middle attacks. In this recipe, we will see some typical attack patterns and their meanings.
Getting ready
When viewing too many ARP requests on a network or when seeing non-standard MAC addresses in the network, connect Wireshark with a port-mirror to their source and start the capture.
How to do it...
To look for ARP/MAC-based attacks, follow these steps:
- Connect Wireshark to any port on the network.
- Look for massive ARP broadcasts. Since ARP requests are broadcasts, they will be distributed in the entire layer 2 network (that is, on a single VLAN). In the following screenshot, you can see a typical ARP-scan pattern. It's important to note that this ARP scan can be an application that works this way, for example, SNMP software that...
