The solution of Hotel ARP Fraud in the case of Network Analysis

Technorati tags: network Analysis, Network Security, arp

Bob Chen 2013-9-29

1. Phenomenon

Location Jiangxia a resort hotel, the Internet is intermittent, very slow, ping gateway found that unable to get through

two。 Preliminary diagnosis

[figure 1]

It can be seen that 192.168.1.1 and 192.168.1.88 are the same mac address, and arp fraud is suspected.

After using arp-d ping 192.168.1.1, the situation is still like figure 1.

Consider using arp-s for static binding of gateways, but you cannot know the real mac of 192.168.1.1

How to bind the correct gateway mac?

3. Use Kelai software to grab packages.

It is found that there are a large number of arp response requests in the intranet, especially 192.168.1.88

You can see that the mac of 192.168.1.1 is 00-14-78-f0-d6-67

4. Statically bind ip and mac

Has Ok found the correct gateway mac? let's try it.

Because arp-s cannot be carried out directly under Win7

The following command is required:

C:\ Users\ thinkpad > netsh i i show in

Idx Met MTU status name

-

1 50 4294967295 connected Loopback Pseudo-Interface 1

17 25 1500 disconnected Wireless Network connection 2

13 20 1500 connected Local connection

24 5 1400 disconnected Local connection * 15

Record the IDX value of the network card

C:\ Users\ thinkpad > netsh-c i i add neighbors 13 192.168.1.1 00-14-78-f0-d6-67

Ping 192.168.1.1 ok, problem resolved.