Network Analysis Case Study-hotel ARP spoofing Solution

1.Symptom

A resort hotel in Jiangxia experienced a slow connection and failed to access the Internet.

2.Initial Diagnosis

Figure 1]

We can see that 192.168.1.1 and 192.168.1.88 are the same mac addresses, and we suspect arp spoofing.

If arp-d is used, the ping to 192.168.1.1 is still 1.

Consider using arp-s for static gateway binding, but cannot know the real mac address of 192.168.1.1

How can I bind a correct gateway mac?

3.Use corai software to capture packets

A large number of arp response requests, especially 192.168.1.88, are found on the Intranet.

The mac address of 192.168.1.1 is 00-14-78-f0-d6-67.

4.Static binding ipAnd mac

OK. Have you found the correct gateway mac? Let's try it.

As arp-s cannot be directly implemented in Win7

Run the following command:

C: \ Users \ thinkpad> netsh I show in

Idx Met MTU status name

--------------------------------------------------------------

1 50 4294967295 connected Loopback Pseudo-Interface 1

17 25 1500 disconnected wireless network connection 2

13 20 1500 connected local connection

24 5 1400 local disconnected connection * 15

Record the idx value of the NIC

C: \ Users \ thinkpad> netsh-c I add neighbors 13 192.168.1.1 00-14-78-f0-d6-67

Ping 192.168.1.1 OK to solve the problem