MITM/Wired/MAC Flood - Revision history

Unknown user at 20:52, 5 March 2022

2022-03-05T20:52:45Z

← Older revision		Revision as of 20:52, 5 March 2022
Line 1:		Line 1:
	One way to cause chaos in a wireless router or switch that you're trying to attack is to overwhelm it with MAC addresses. Eventually, the number of devices will become so large that the router will stop trying to store MAC addresses and will revert to failopen mode. This means that a network switch (in which each port only sees traffic destined for it) becomes a network hub (in which all ports see all traffic), making sniffing possible.		=Overview=

	~~This~~ uses the ~~<code>macof</code>~~ tool in the Dsniff suite.		==MAC Addresses==

			A MAC address is a digital fingerprint that is associated uniquely with a physical device. In theory, no two mac addresses should be the same. In practice, the MAC address can be controlled and spoofed.

			MAC addresses are important on local networks because the DHCP server (or router) needs some way to identify different machines in order to hand out IP addresses. The MAC address is associated with OSI Level 2 (Device), while the IP address is associated with OSI Level 3 (Network).

			==CAM Table==

			It is important for a router or DHCP server to keep track of the different MAC addresses it has seen, so that it can recognize a returning device versus new devices. To do that, the router uses a CAM table, which is a table of all MAC addresses the router has seen.

			The CAM table is the weak point of the system - if the CAM table breaks, then the router can't properly keep track of what MAC addresses it has seen before, or which MAC addresses have been assigned which IP addresses.

			==MAC Flood Attack==

			Once the CAM table is broken, an ARP spoofing attack becomes possible - the attacker sends ARP packets to the router that instruct it to associate the victim IP address with the attacker MAC address, routing all victim traffic to the attacker machine.

			The MAC flood attack targets the CAM table. It generates a large number of random MAC addresses in order to flood the CAM table with junk and break the link between Layer 2 and Layer 3.

			==Tools==

			See [[Macof]] for a tool to perform MAC flooding attacks. Macof is part of the [[Dsniff]] suite of tools.


			=Links=

			=Flags=

			{{MITMFlag}}

			{{KaliFlag}}

Unknown user: Admin moved page Man in the Middle/Wired/MAC Flood to MITM/Wired/MAC Flood

2022-03-05T20:41:06Z

Admin moved page Man in the Middle/Wired/MAC Flood to MITM/Wired/MAC Flood

← Older revision	Revision as of 20:41, 5 March 2022
(No difference)

Admin: Created page with "One way to cause chaos in a wireless router or switch that you're trying to attack is to overwhelm it with MAC addresses. Eventually, the number of devices will become so larg..."

2015-08-27T08:28:45Z

Created page with "One way to cause chaos in a wireless router or switch that you're trying to attack is to overwhelm it with MAC addresses. Eventually, the number of devices will become so larg..."

New page

One way to cause chaos in a wireless router or switch that you're trying to attack is to overwhelm it with MAC addresses. Eventually, the number of devices will become so large that the router will stop trying to store MAC addresses and will revert to failopen mode. This means that a network switch (in which each port only sees traffic destined for it) becomes a network hub (in which all ports see all traffic), making sniffing possible.

This uses the <code>macof</code> tool in the Dsniff suite.