Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There seem to be many possible ways to create man-in-the-middle attacks on public access points, by stealing the access point's local IP address with ARP spoofing. The possible attacks range from forging password request fields, to changing HTTPS connections to HTTP, and even the recently discovered possibilit of injecting malicious headers in the beginning of secure TLS connections.

However, it seems to be claimed that these attacks are not very common. It would be interesting to see for myself. What ways are there to detect if such an attack is being attempted by someone on the network?

I guess getting served a plain HTTP login page would be an obvious clue, and of course you could run Wireshark and keep reading all the interesting ARP traffic... But an automated solution would be a tiny bit more handy. Something that analyzes stuff on the background and alerts if an attack is detected on the network. It would be interesting to see for myself if these attack are actually going on somewhere.

share|improve this question
Search on sourceforge, there are some anti-arp spoofing tools there. – geek Dec 11 '09 at 15:28
up vote 5 down vote accepted

There is no way to detect an arbitrary MITM, because there are several techniques to perform them.

However, most MITM attacks on Ethernet or WLAN use ARP spoofing to redirect traffic. There are tools to detect ARP spoofing, these should indicate most MITM attacks. See e.g. the Wikipedia page for some tools.

share|improve this answer

There's no fail-proof way of detecting this (if there was, MitM attacks wouldn't be a problem!). There're a few possible techniques, though.

You could try looking at the times it takes to serve something; a delay might indicate a MitM attack occurring. Or it could just indicate the network is being slow.

If you think someone is editing the content of things you're sending/receiving over the public network, you could check fingerprints/MD5 hashes/etc. of the data you're sending/receiving.

As Maciek points out, if the MitM is playing with certificates and SSL connections, that should be fairly obvious, as browsers will warn you if certificates don't match up (although you have to be able to trust your browser; if someone has installed fake certificates on your computer already, this isn't much use).

share|improve this answer

MiM attacks are done against encrypted traffic (You don't have to do MiM in non encrypted traffic, you can just sniff it).

There is some math behind it but long story short: you have to check key finger print. So for example when you login via ssh first time ssh client displays the servers fingerprint. If you want to protect against MiM you mast know this fingerprint before login attempt (for example ask admin using other secure channel, for example face to face conversation).

This is a very impractical. The answer for this problem are Certificate authoritys ( In this scenario computer holds known fingerprints of keys of trusted companies. That companies signing keys for other companies. It is important to check if used certificate is signed correctly. Fortunately modern browsers do this automatically, and display a lot of warnings if something is wrong.

share|improve this answer
no, MiM attacks can be used against unencrypted traffic as well. not necessary if all you want is to sniff traffic, but useful if you want to change some of the data before passing it along. – quack quixote Dec 11 '09 at 12:14

arpwatch works for me:

sudo aptitude install arpwatch
echo "wlan3 -a -n -m" | sudo tee -a /etc/arpwatch.conf
/etc/init.d/arpwatch start

Like you said, it would be nice to automate the defense. looks like it would help with sending SMS alerts, etc. The rest is up to you and your MTA (postfix) and e-mail filters.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .