0

I would like to know how to do a simple ARP poison attack with UNIX commands only (no ettercap or arpspoof or anything like that.) I don't care about forwarding packets to the actual router, I just want to drop them. I heard that it works by sending fake arp packets to machines that want to know what the router's MAC address is. How could this be done as simply as possible?

1
  • Nothing, because I have no idea how I might go about doing this. Mar 28, 2016 at 22:08

1 Answer 1

2

As Linux and the BSDs (including OS X) diverge, the instructions for how to do this on a given Unix-like OS are also diverging. Here are some instructions for OS X.

  1. Find your router's IP address, perhaps by running netstat -rnaf inet and looking at the "default" route at the top of the list.
  2. Find your router's MAC address, perhaps by running arp -an and looking for your router's IP address.
  3. Tell your network interface to use your router's MAC address:
    sudo ifconfig en0 ether 00:11:22:33:44:55
  4. Hope it works. Without purpose-built tools for ARP spoofing, you're at the mercy of your network stack's ARP code. If your network stack has modern ARP code, it might not try to fight to own that MAC address if there's already someone else using it (which there of course will be: your router).

I'm not aware of any widely deployed, "built-in" Unix command-line tools that let you forge custom ARP packets. That's why people install other commands like arpspoof and ettercap.

In OS X, you can transmit any arbitrary sequence of bytes that you like, by way of the Berkeley Packet Filter kernel facility. Just open(2) a /dev/bpfX device, use ioctl(2) to attach it to an interface like en0, and write bytes to it. Each individual write (that is, each buffer of bytes handed off in an individual call to write(2)) is transmitted as a packet. But that's a little beyond what you can easily do with a shell script. I think most Unix graybeards would whip up a little C tool to do that. But that's basically reimplementing key functionality of some other well-known ARP-spoofing tool, and in modern Unix environments, it's easier to tell your package manager to install arpspoof or ettercap or something.

4
  • Thanks, could you please tell me how I might "whip up a little C tool to do that"? I know it will be complicated, so please comment your code. Thanks in advance! Mar 28, 2016 at 22:20
  • @RobertMoore - You would need to attempt to do that yourself, post any questions you have on Stackoverflow, you have no idea what you are asking for.
    – Ramhound
    Mar 28, 2016 at 22:24
  • 1
    @RobertMoore You seem like you may be new to asking complicated technical questions on the Internet. Please read ESR's famously helpful guide, "How to Ask Questions the Smart Way".
    – Spiff
    Mar 28, 2016 at 22:59
  • Your ifconfig en1 ether worked for ANY mac address except the router's (so my computer can mimic the MAC address of devices on the network, but not the router.) Just wondering, if I set my MAC address to that of a computer on the network, does all traffic go to me, both devices, only the original device, or neither? Mar 30, 2016 at 19:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .