Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am currently living in an apartment with a shared internet connection. All rooms in the building are connected to a switch, which is hooked up to some fiber connection. Now, someone was wise enough to change his MAC and IP address to the default gateway (the route to the modem), which now makes all internet traffic go to this person instead of the modem (I thought there was some kind of protection against malicious arp offers?). The sad part is: I don't have physical access to the switching equipment, so I can't reset them. Is there any way to undo the changes made to the switch's internal mac tables without having access to the switch? Do these internal tables have some sort of TTL fields? If not, is there any other way to access the modem? (I tried associating the FF:FF:FF:FF:FF:FF address with the IP of the default gateway in my arp table, without success)

share|improve this question
    
Maybe he/she changed the IP of the gateway as well. Because if they have the same IP, their computer would have IP conflict. –  Radoo May 12 '12 at 21:53
add comment

1 Answer

up vote 0 down vote accepted

You could cut the power for a few seconds if you have access to it - this will reset the internal tables. One thing you could also try is to flood the MAC table of the router - google it and you'll find software that can do this. If the table is flooded the old entries should be flushed out or it starts to behave like a hub - broadcasting all packets to every port

share|improve this answer
    
Thanks, that seems to work indeed. Any idea why the mac broadcast address didn't work? –  JeffersonB May 12 '12 at 22:30
    
I didt not quite understand what commands you have used/what you tried to do, especially why you used the broardcast MAC address. But if you have added a static ARP entry with the IP address of your gateway associated to its mac than you should've been able to access your gateway via IP. This will however only work for your own machine - to fake ARP announcements for the gateway you'd need special software. –  leepfrog May 12 '12 at 23:11
    
I just used arp -s 10.92.40.1 FF:FF:FF:FF:FF:FF When the packages are broadcasted to all ports, I thought the internet gateway would get it as well (it then wouldn't matter the CAM tables are messed up) –  JeffersonB May 13 '12 at 10:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.