Discovering MAC- and ARP-based attacks
There are various types of layer-2 MAC-based attacks and layer-2/3 ARP attacks that can be easily discovered by Wireshark. These attacks are usually caused by scanners (described in the next recipe) and man-in-the-middle attacks (described in the Analyzing connectivity problems with ARP recipe in Chapter 8, ARP and IP Analysis). In this recipe, we will see some typical attack patterns and their meanings.
Getting ready
When viewing too many ARP requests on a network or when seeing non-standard MAC addresses in the network, connect Wireshark with port mirror to their source and start the capture.
How to do it...
To look for ARP/MAC-based attacks, follow these steps:
- Connect Wireshark to any port on the network.
- Look for massive ARP broadcasts. Since ARP requests are broadcasts, they will be distributed in the entire layer-2 network (that is, on a single VLAN). In the following screenshot, you can see a typical ARP-scan pattern. It's important to note...
