Project 16: Detecting Promiscuous NICs with ARP (15 pts.)

What You Need

Two Windows machines (any version) networked together. I wrote the instructions using two virtual machines: one running Windows 7 and the other running Windows Server 2008.
Pick one machine to be the SCANNER. The other one is the TARGET. The instructions below assume you are using Windows 7 as the SCANNER and Windows Server 2008 as the TARGET.

Purpose

Learn how the ARP command works, and use it to detect promiscuous NICs.

Turning off the Firewall on the Windows 7 SCANNER Machine

On the Windows 7 SCANNER Machine, Click Start. In the Search box, type FIREWALL

In the search results, click "Windows Firewall".

Be careful not to click "Windows Firewall with Advanced Security".

On the left side of the "Windows Firewall" box, click "Turn Windows Firewall on or off".

Click both "Turn off Windows Firewall (not recommended)" buttons, as shown below:

In the "Customize Settings" box, click the OK button.

Turning off the Firewall on the Windows Server 2008 TARGET Machine

On the Windows Server 2008 TARGET Machine, click Start. In the Search box, type FIREWALL

In the search results, click "Windows Firewall".

Be careful not to click "Windows Firewall with Advanced Security".

On the left side of the "Windows Firewall" box, click "Turn Windows Firewall on or off".

Click the Off" button, as shown below:

In the "Windows Firewall Settings" box, click the OK button.

Finding the TARGET Machine's IP Address

On the Windows Server 2008 TARGET machine, click Start. In the Search box, type CMD

Press the Enter key.

A Command Prompt window opens.

Execute this command:

IPCONFIG /ALL

In the "Ethernet adapter Local Area Connection" section, your TARGET's "Physical Address" and "IPv4 Address" are shown, as shown below.

Make a note of these addresses--you will need them later.

There are extra adapters below the real one in the output, such as "Tunnel adapter Local Area Connection* 8"--these are virtual adapter Windows makes for IPv6 tunneling. Just ignore them.

Finding the SCANNER Machine's IP Address

On the Windows 7 SCANNER machine, click Start. In the Search box, type CMD

In the Search results, right-click cmd.exe and click "Run as administrator", as shown below:

If a "User Account Control" box pops up, click Yes.

An Administrator Command Prompt window opens.

Execute this command:

IPCONFIG /ALL

Scroll back up to find the "Ethernet adapter Local Area Connection" section, as shown below.

Find your SCANNER's "IPv4 Address", as shown below.

There are extra adapters below the real one in the output, such as "VMwnet" and "Tunnel" adapters. Just ignore them.

Comparing Addresses

Examine the IPv4 addresses of the SCANNER and TARGET machines.

Make sure the SCANNER is on the same subnet as the TARGET. In the images above, they are both on the 192.168.119.0/24 network.

If the two machines are not on the same subnet, this project won't work. The most common cause of that is using virtual machines with different networking settings. To fix it, configure all virtual network adapters to "Bridged" mode, as you did in the earlier project introducing virtual machines.

Testing the Network with PING

On the Windows 7 SCANNER machine, in the Administrator Command Prompt window. execute this command. Replace the IP address with the IP address of your TARGET machine.

PING 192.168.119.191

You should see replies, as shown below.

If you don't see replies, you need to troubleshoot your network before proceeding. Make sure all firewalls are off and that all virtual networks are set to "Bridged" mode.

Monitoring ICMP and ARP Traffic with Wireshark on the SCANNER machine

On the SCANNER machine, start Wireshark. If Wireshark is not installed, get it here:

http://www.wireshark.org/

In Wireshark, on the left side, highlight your real network adapter (not a virtual one), as shown below, and click Start.

In Wireshark, at the top left, in the Filter bar, type in this text, and then press the Enter key:

icmp || arp

Note: the | character is called "pipe" and you type it with Shift+\

The filter bar turns green, and you will probably see some ARP packets, as shown below.

Monitoring ICMP Traffic with Wireshark on the TARGET machine

On the TARGET machine, start Wireshark. If Wireshark is not installed, get it here:

http://www.wireshark.org/

Configure Wireshark to show ICMP traffic, as shown below.

Examining ARP Resolution from the SCANNER Machine

On the Windows 7 SCANNER machine, in the Administrator Command Prompt window. execute these commands, pressing the ENTER key after each one.

Replace the IP address with the IP address of your TARGET machine.

The first command clears the ARP cache, so your SCANNER machine forgets all its information about the TARGET machine.

Therefore, before it can send the PING, it must perform an ARP request and receive an ARP reply, which we will examine.

ARP -D *
PING 192.168.119.191

You should see replies, as shown below.

On the SCANNER machine, in the Wireshark window, click Capture, Stop.

Scroll up if necessary, and find the three packets shown below, in this order. Make sure you understand all the addresses in the packets:

ARP Request: Who has TARGET-IP? Tell SCANNER-IP
ARP Reply: TARGET-IP is at TARGET-MAC
ICMP Echo (ping) request

Examining an ICMP Request on the TARGET Machine

On the Windows Server 2008 TARGET machine, in the Wireshark window, click Capture, Stop.

Scroll up if necessary, and find an ICMP Echo (ping) request from the SCANNER IP address, as shown below.

In the upper pane of Wireshark, click the "ICMP Echo (ping) request" line to highlight it.

In the middle pane of Wireshark, examine the four sections, labelled by OSI layers in the image below. Make sure you can find these things:

Layer 1: Frame information showing the number of bytes on the wire
Layer 2: Src showing the SCANNER's MAC address and Dst showing the TARGET's MAC address
Layer 3: Src showing the SCANNER's IPv4 address and Dst showing the TARGET's IPv4 address
Layer 7: ICMP

Saving a Screen Image

Make sure the top pane of Wireshark shows an "ICMP Echo (ping) request" line, and that the middle pane shows the "Ethernet ... Dst" MAC address, as shown above.

Click on the host machine's taskbar to make it the recipient of keypresses.

On your keyboard, press the PrntScrn key.

Click Start, type in PAINT, and open Paint.

Press Ctrl+V to paste in the image of your desktop.

YOU MUST SUBMIT WHOLE-DESKTOP IMAGES TO GET FULL CREDIT.

Save the image with a filename of "Proj 16a from YOUR NAME".

Restarting a Wireshark Packet Capture on the TARGET Machine

On the Windows Server 2008 TARGET machine, in Wireshark, click Capture, Start.

A box pops up, asking "Do you want to save...". Click "Continue without Saving".

Changing the ARP Cache

On the Windows 7 SCANNER machine, in the Administrator Command Prompt window. execute these commands, pressing the ENTER key after each one.

Replace the IP address with the IP address of your TARGET machine in the second and third command, but leave the strange MAC address "AA-AA-AA-AA-AA-AA" as it is.

The first command clears the ARP cache.

The second command adds a false entry to the ARP cache, saying the MAC address of the target is "AA-AA-AA-AA-AA-AA".

The third command displays the ARP cache, showing the new strange value "aa-aa-aa-aa-aa-aa", as shown below.

ARP -D * ARP -S 192.168.119.191 AA-AA-AA-AA-AA-AA
ARP -A

Troubleshooting
You may see the correct MAC address in the cache instead of "aa-aa-aa-aa-aa-aa" if you execute the commands too slowly.
If that happens, use the up-arrow key on the keyboard to repeat the three commands more quickly.

Saving a Screen Image

Make sure you can see a Physical Address of "aa-aa-aa-aa-aa-aa", as shown above.

Click on the host machine's taskbar to make it the recipient of keypresses.

On your keyboard, press the PrntScrn key.

Click Start, type in PAINT, and open Paint.

Press Ctrl+V to paste in the image of your desktop.

YOU MUST SUBMIT WHOLE-DESKTOP IMAGES TO GET FULL CREDIT.

Save the image with a filename of "Proj 16b from YOUR NAME".

Sending Strange PINGs

On the Windows 7 SCANNER machine, in the Administrator Command Prompt window. execute this command.

Replace the IP address with the IP address of your TARGET machine.

PING 192.168.119.191

You should see replies, as shown below.

Viewing the Strange PINGs on the TARGET Machine

On the Windows Server 2008 TARGET machine, in the Wireshark window, click Capture, Stop.

Scroll up if necessary, and find an ICMP Echo (ping) request from the SCANNER IP address, as shown below.

In the upper pane of Wireshark, click the "ICMP Echo (ping) request" line to highlight it.

In the middle pane of Wireshark, you should see "Dst: aa:aa:aa:aa:aa:aa", as shown below.

Saving a Screen Image

Make sure you can see "Dst: aa:aa:aa:aa:aa:aa", as shown above.

Click on the host machine's taskbar to make it the recipient of keypresses.

On your keyboard, press the PrntScrn key.

Click Start, type in PAINT, and open Paint.

Press Ctrl+V to paste in the image of your desktop.

YOU MUST SUBMIT WHOLE-DESKTOP IMAGES TO GET FULL CREDIT.

Save the image with a filename of "Proj 16c from YOUR NAME".

Understanding Promiscuous Mode

This is a strange result--why did this packet reach the target, despite an incorrect MAC address?

It happens because Wireshark places your network adapter into "promiscuous mode", so it accepts any packet that arrives, whether its destination MAC address is correct or not.

This is a simple way to detect network adapters in promiscuous mode. Send a packet with the correct IP address but the wrong MAC address. If the target replies, it is in promiscuous mode.

There is no reason to use promiscuous mode for normal networking, but hackers use it often, so it's useful to know which machines are using it.

Turning in Your Project

Email the images to: cnit.106sam@gmail.com with a subject line of Proj 16 From Your Name, replacing Your Name with your own first and last name. Send a Cc to yourself.

Last Modified: 10-23-13 11:58 am