ARPSpo的ofingandManintheMiddleattackusingEttercap.doc

ARP Spoofing and Man in the Middle attack using Ettercap Debashis Roy, Katayoon Moazzami and Rachita SinghSchool of Computer Science, University of Windsor, Canada {roy17, moazzam, singh12s}@uwindsor.ca Abstract In this paper, we are trying to explain how to do ARP poisoning that allows us to implement the man in the middle attack and to modify the network packets before sending them to the victim. We have used Ettercap tool to perform this attack. Ettercap intercepts the traffic and can modify the payload field of the packet based on some filtering options. The attacker can design the filter to drop, alter or inject new packets. We will also describe some tools such as xarp and arpwatch, which can be used to detect the arp poisoning. Introduction A computer connected to an IP/Ethernet LAN has two addresses. One is the MAC address, the address of the network card, which is a globally unique and unchangeable address and is stored on the network card itself. MAC addresses are essential for the Ethernet protocol to send data back and forth, independent of different application protocols. Ethernet builds frames of data. Each frame consists of up to 1500 bytes of data. Each frame has an Ethernet header which contains the MAC addresses of the source and the destination computers. The second address is the IP address. Each computer on a network must have a unique IP address to communicate. IP address is virtual and is assigned via software. Applications use IP protocol independent of whatever network technology operates underneath it. IP and Ethernet work together. The IP protocol first creates “packets” which has different structure than the frames. But to deliver the packets to Ethernet these have to be changed to frames. So the Ethernet protocol splits the packets into frames, adds Ethernet header to the frames, and sends them down the cable. When an Ethernet frame is constructed from an IP packet, the MAC address of the destination machine is required to create