hacking security forum

Re: [Full-Disclosure] Static ARP Replies?

From: Grishnav <grishnav@egosurf.net>
Date: Sat Aug 07 2004 - 14:56:15 EDT

Dan Taylor, Jr. wrote:

>Here's what happens on one of these networks:
>
>Say the AP's MAC address is DE:AD:C0:DE:CA:FE, with the IP of
>192.168.1/255.255.255.0, and I send out an ARP request for hosts
>192.168.1.2-254.
>
>Say my MAC address is FE:ED:FA:CE:BE:EF, with the IP address of 192.168.1.100
>--> ARP broadcast (source FE:ED:FA:CE:BE:EF destination FF:FF:FF:FF:FF:FF)
>--> Who has 192.168.1.2? Tell 192.168.1.100
>
>--< ARP Reply (source DE:AD:C0:DE:CA:FE, destination FE:ED:FA:CE:BE:EF)
>--< 192.168.1.2 is at DE:AD:C0:DE:CA:FE
>
>

 From the information you've posted, I have no reason to assume that the
AP's IP isn't 192.168.1.2, and that this isn't normal behavior.

Clarify? What's the IP of the AP? Okthx.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Received on Sat Aug 07 15:15:44 2004

This archive was generated by hypermail 2.1.8 : Sat Aug 07 2004 - 16:01:12 EDT