LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-24-2007, 06:12 PM   #1
yawe_frek
Member
 
Registered: Sep 2005
Distribution: feather 0.72-usb, DSL,CentOS,Ubuntu, Redhat 9
Posts: 144

Rep: Reputation: 15
Arp Poisoning


hi guys,

i have been hearing so much about arp poisoning. pls if i may ask what type of attack is this and how do i know that my system is under such attack. lastly, what is the point of action/remedy to prevent such


thanks
 
Old 05-24-2007, 07:49 PM   #2
vtel57
Senior Member
 
Registered: Jul 2006
Location: USA
Distribution: Slackware64 - 14.2 w/ Xfce
Posts: 1,631

Rep: Reputation: 489Reputation: 489Reputation: 489Reputation: 489Reputation: 489
Google is your friend. Try it sometime...

http://en.wikipedia.org/wiki/ARP_spoofing <-- first hit on Google.

I'm not trying to be a smart ass here. I'm just trying to enlighten you to the fact that it took less keystrokes for me to do that Google search, which gave many relevant hits, than it did for you to post this query. Searching is good for you!

Have FUN!
 
Old 05-24-2007, 09:09 PM   #3
hackintosh
Member
 
Registered: Dec 2005
Posts: 52

Rep: Reputation: 15
May 18 19:00:00 kule8 newsyslog[49864]: logfile turned over due to size>100K
May 18 19:00:00 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:01 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:06 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:07 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:10 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:10 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:15 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:16 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:21 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:22 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:29 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:32 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:36 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:38 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:42 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:44 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:45 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:46 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:51 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:53 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:54 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:56 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:00:57 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:00:59 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:00 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:02 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:05 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:08 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:08 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:11 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:11 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:14 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:14 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:17 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:17 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:20 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:24 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:26 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:29 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:29 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:35 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:35 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:41 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:41 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:44 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:47 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:47 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:50 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:01:56 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:01:57 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:02:00 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:02:00 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:02:03 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:02:06 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:02:06 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:02:09 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:02:15 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:02:18 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:02:22 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:02:24 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:02:30 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:02:31 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0
May 18 19:02:37 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:a9:e3:c3 to 00:30:18:ab:a9:25 on re0
May 18 19:02:41 kule8 kernel: arp: 192.168.1.249 moved from 00:30:18:ab:a9:25 to 00:30:18:a9:e3:c3 on re0

see this :P
 
Old 05-26-2007, 06:13 PM   #4
Crito
Senior Member
 
Registered: Nov 2003
Location: Knoxville, TN
Distribution: Kubuntu 9.04
Posts: 1,168

Rep: Reputation: 53
You could save even more time by searching this forum for "arp poisoning". You'll get even more relevant info on the first page.

@hackintosh: the first 00:30:18 identify the NIC manufacturer, which I'm showing as Jetway Information Co., Ltd. Could just be coincidence the "hacker" is using the same brand, or you could have a dual NIC mobo and some kind of configuration problem instead of a security problem.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Strange ARP behavior : A linux server responds to all ARP requests Hdvd21 Linux - Networking 4 10-24-2013 05:02 AM
arp poisoning Cisco counter measure? GUIPenguin General 1 10-14-2005 04:42 PM
ArpStar 0.5.0 Defeats ARP poisoning bassdemon Linux - Security 14 02-21-2005 01:32 PM
detecting/preventing arp cache poisoning? SocialEngineer Linux - Security 6 08-20-2004 11:52 AM
How to create an proxyarp entry in arp table by using arp command? himalayas Linux - Networking 0 06-04-2003 04:14 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 03:51 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration