LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 07-21-2011, 02:51 PM   #1
gettons1980
LQ Newbie
 
Registered: Jun 2008
Posts: 21

Rep: Reputation: 0
simple question regarding arp poisoning on a wlan


Hi all,
a very quick one:

Being wireless networks broadcast what is the reason why you would use arp spoofing on a wireless network.
I mean i get it if you are on a wired one as with switches you wont intercept someone else's packets so using arp spoofing you place yourself between gateway and client.
But on a wireless network which broadcasts packets because of the nature of the media ( air ), why would you you do this?


Thanks in advance
 
Old 07-21-2011, 03:38 PM   #2
biggie_
LQ Newbie
 
Registered: Jul 2011
Distribution: arch,ubuntu
Posts: 17

Rep: Reputation: 1
Simple answer: ethernet broadcasts

edit: just read this

Last edited by biggie_; 07-21-2011 at 03:54 PM.
 
Old 07-21-2011, 04:01 PM   #3
gettons1980
LQ Newbie
 
Registered: Jun 2008
Posts: 21

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by biggie_ View Post
Simple answer: ethernet broadcasts

edit: just read this


Read that document already but I couldn't get it too much.
Can you be a bit more specific ?
 
Old 07-21-2011, 04:39 PM   #4
biggie_
LQ Newbie
 
Registered: Jul 2011
Distribution: arch,ubuntu
Posts: 17

Rep: Reputation: 1
http://en.wikipedia.org/wiki/OSI_model
 
Old 07-21-2011, 10:05 PM   #5
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
Quote:
Originally Posted by gettons1980 View Post
But on a wireless network which broadcasts packets because of the nature of the media ( air ), why would you you do this?
Did you read the ARP Poisoning section in the document linked by biggie_?
 
Old 07-22-2011, 01:53 AM   #6
gettons1980
LQ Newbie
 
Registered: Jun 2008
Posts: 21

Original Poster
Rep: Reputation: 0
Maybe I am have not been clear enough, I am sure my bad English is responsible :-)
my original question was with regards of wireless clients only.
I mean I have a wireless client A connected to AP and I am not interested at ANY wired box.
if I want to sniff packets coming TO and FROM client A,once I am associated with the AP and know the encryption key ( if any ),do I just need to wireshark on my interface to sniff the traffic ?
If I do arp poisoning against the client A would this change the packets quantity,quality and typology at all or would it be exactly the same as wiresharking ?


Thanks.

Last edited by gettons1980; 07-22-2011 at 01:55 AM.
 
Old 07-22-2011, 09:28 AM   #7
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
If all the bad guy cares about is sniffing Ethernet frames, then yeah, it would probably be pointless to mess with ARP. However, ARP poisoning would allow him/her to not only sniff the frames, but also redirect them to hostile nodes, modify them, or even black hole them (DoS). If, for example, his/her objective is to carry out a MITM attack against your Gmail HTTPS session, then being able to sniff Ethernet frames won't on its own do him/her any good, while ARP poisoning could prove to be a vital component in the attack.

Last edited by win32sux; 07-22-2011 at 09:30 AM.
 
Old 07-22-2011, 11:45 AM   #8
gettons1980
LQ Newbie
 
Registered: Jun 2008
Posts: 21

Original Poster
Rep: Reputation: 0
Sure,with smthg like sslstrip.
Of course arp poising gives you much more,my question was only an "academic" question.

Thanks
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
arp poisoning vs arp spoofing sulekha Linux - Networking 1 05-13-2009 04:22 AM
ARP Poisoning mudasirm Linux - Networking 9 09-11-2008 06:32 PM
Arp table poisoning cristian1983 Linux - Security 2 12-28-2007 01:31 PM
Arp-poisoning help! zaheer Linux - Networking 5 07-25-2007 10:34 PM
Arp Poisoning yawe_frek Linux - Security 3 05-26-2007 06:13 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:25 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration