Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently living in an apartment with a shared internet connection. All rooms in the building are connected to a switch, which is hooked up to some fiber connection. Now, someone was wise enough to change his MAC and IP address to the default gateway (the route to the modem), which now makes all internet traffic go to this person instead of the modem (I thought there was some kind of protection against malicious arp offers?). The sad part is: I don't have physical access to the switching equipment, so I can't reset them. Is there any way to undo the changes made to the switch's internal mac tables without having access to the switch? Do these internal tables have some sort of TTL fields? If not, is there any other way to access the modem? (I tried associating the FF:FF:FF:FF:FF:FF address with the IP of the default gateway in my arp table, without success)

share|improve this question
Maybe he/she changed the IP of the gateway as well. Because if they have the same IP, their computer would have IP conflict. – user127350 May 12 '12 at 21:53
up vote 0 down vote accepted

You could cut the power for a few seconds if you have access to it - this will reset the internal tables. One thing you could also try is to flood the MAC table of the router - google it and you'll find software that can do this. If the table is flooded the old entries should be flushed out or it starts to behave like a hub - broadcasting all packets to every port

share|improve this answer
Thanks, that seems to work indeed. Any idea why the mac broadcast address didn't work? – JeffersonB May 12 '12 at 22:30
I didt not quite understand what commands you have used/what you tried to do, especially why you used the broardcast MAC address. But if you have added a static ARP entry with the IP address of your gateway associated to its mac than you should've been able to access your gateway via IP. This will however only work for your own machine - to fake ARP announcements for the gateway you'd need special software. – leepfrog May 12 '12 at 23:11
I just used arp -s FF:FF:FF:FF:FF:FF When the packages are broadcasted to all ports, I thought the internet gateway would get it as well (it then wouldn't matter the CAM tables are messed up) – JeffersonB May 13 '12 at 10:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .