In my Network are:
Router
Client 1: Victim
Client 2: Attacker (Raspberry Pi)
Client 3: My Computer (SSH to Raspberry)
All Clients are connected wireless to the router.
All Clients are registered at the Router (IP/MAC bind)
Router is set to accept connection only from registered Clients.
Router has DHCP enabled.
Programm used: dsniff/arpspoof
I arpsoofed client 1 and set Client 2 to act as MITM and forwarded the traffic. As soon as router refreshes arp tables it works.
After 5-10 minutes the router assign a new IP to Client 1 and forgot the old IP Adress.
I've got 2 questions now:
What is IP/MAC binding for when its easy to manipulate one client to use multiple IPs and router accepting it?
How is it possible that the spoofed client 1 who shouldnt have any communication with the router directly is given a new IP after some time?
This is for education purposes only!
Thank you !
Best Answer
What you are describing is more about network disruption than information stealing. Also, clients don't register with routers, and DHCP is gratuitous in the situation you describe because the DHCP server plays no part in the situation.
There really isn't any such thing as IP/MAC binding they way you may think. You need to understand the network layers. Layer-2 is the local LAN, and all traffic on the local LAN is delivered directly from one host to another host by the LAN, e.g. MAC, address. Some layer-2 protocols use MAC addresses (either 48-bit or 64-bit MAC addresses), and some do not. Layer-3 is the network, and layer-3 protocols use layer-3, e.g. IP, addresses.
In order for one host on the LAN to send traffic to another host on the LAN, the host needs to resolve the destination layer-3 address into the destination layer-2 address in order to build a frame. That is where ARP (Address Resolution Protocol) comes in.
ARP maintains a table for translating layer-3 to layer-2 addresses. The entries in this table usually time out, but that depends on the OS. To get or update an entry in its ARP table, a host will use ARP requests. A host will also update its ARP table from any traffic it sees on the LAN. That means that when the victim sends out any traffic that the other hosts see, they will update their ARP tables with the new information. This could be the victim sending its own ARP request to discover the layer-2 address of another host, a gratuitous ARP, unknown unicast traffic, or unicast traffic to another host that updates it ARP table.
There is also something else to consider if this is a switched ethernet LAN. Ethernet switches maintain MAC address tables (not to be confused with ARP tables) to resolve the MAC address to an interface where the MAC address was last seen. A switch will update its MAC address table with a frame's source MAC address every time a frame comes into the switch, and it will use the MAC address table to determine to which switch interface it will send the frame with the destination MAC address. If the destination MAC address is not in its MAC address table, the switch will flood the frame to all the switch interfaces, except the one where the frame entered the switch.
Now, put it all together. If a malicious host tries to hijack a MAC address, it will only be temporary because the ARP tables in the other hosts will update, and the switch will constantly change the interface to which it delivers frames with that destination MAC address.
A real man-in-the-middle attack needs to happen on a link through which traffic must pass, but that is not the case on most LANs since traffic on LANs is passed directly from host-to-host, not through a single point.