Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: A bit strange ARP queries
From: Tillmann Werner (tillmann.wernergmx.de)
Date: Fri Dec 16 2005 - 12:29:31 CST
that trace is more than a bit strange and should be really alarming. One can
do lots of dirty things abusing ARP.
> Has anyone seen such ARP packets? I am a bit curious, because we have no
> strange hardware that will set the target hardware address in the who-has
> ARP packet. Are there any attacks that using such packets?
Mapping the MAC addresses to vendors - i.e., using
<http://standards.ieee.org/regauth/oui/index.shtml> - fails, except for
0:0:1f:0:a:c7 (and the replies, of course).
Another interesting thing is that some of the MAC addresses are multicast
addresses (the lsb of the first octet is 1). That would at least explain the
failed mappings, but as far as I know it makes no sense to send frames with a
multicast source address. Furthermore, these addresses are not well-known,
comparing to <http://www.cavebear.com/CaveBear/Ethernet/multicast.html>.
An slight idea is that there is some system writing crap on the wire,
interpreted as ARP by tcpdump. I have seen such cases before... this is
really hard to detect.
Answering the following questions might help you during further investigation
o Do you see those requests just in a single broadcast domain?
o Is that a switched network?
o What's the link layer protocol? Ethernet?
o What protocols do you run in the involved networks
(ipv4, ipv6, routing protocols, ...)?
o Does a full hexdump provide more details (tcpdump -X)?
o Is the IP address in the ARP requests assigned in your network?
o Has anything changed in network setup?
Hope my understanding of ARP and MAC is right. :-)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
-----END PGP SIGNATURE-----