Zebra, what are you doing?
Are you a nasty Zebra?
Well done Zebra.
Let's break some networks. In this video, I'm going to show you how to implement dynamic ARP inspection,
dynamic ARP inspection stops, attacks such as ARP poisoning and man in the middle attacks.
In a previous video, which I've linked here and below, I showed you how to use Kali or Kali Linux
if you prefer to implement a man-in-the-middle attack by poisoning the ARP caches of devices.
We had Kali poisoning the ARP cache of a Windows device and a Cisco router and then implementing a man
in the middle attack where all traffic from that Windows host to its default gateway, the Cisco router,
was routed or switched in this case through the Kali Linux host.
So Kali was able to see all the traffic from Windows to the router and Windows to the Internet
as an example, we were able to capture Telnet passwords and HTTP passwords.
You shouldn't be using clear text protocols in your network today, so you shouldn't be using protocols
such as HTTP or Telnet.
But if someone did use clear text passwords, I'd have visibility of those passwords and have visibility
of the data because all traffic is sent through the Kali Linux host, which in this case implemented
a man in the middle attack.
We can stop that kind of nonsense by implementing dynamic ARP inspection.
Dynamic ARP inspection requires either DHCP snooping or that you manually configure MAC addresses.
The switch is basically snooping or listening in on DHCP requests from hosts or devices to the DHCP server
and then is creating dynamically when using DHCP snooping a MAC address to IP address mapping to an interface.
So it says this Mac address, this IP address belongs on this interface.
If you change your Mac address, that traffic is denied
and I'm going to demonstrate that using Kali Linux in this video.
So I'm going to show you how you can implement DHCP Snooping, Dynamic ARP inspection and then stop Kali
from sending traffic when it changes its Mac address.
So we're going to stop ARP poisoning attacks. Now to make it easier,
I've added this presentation below
this video.
This presentation shows you the network that I'm using and then shows you how to configure dynamic ARP
inspection.
So I've got links in here to Cisco and other websites that give you more information.
But I also show you how to configure both DHP snooping as well as dynamic up inspection.
So in this video, I'm going to show you quite a lot of detail how this all works.
Use the menu here to jump to a specific topic if you want to.
So I'm going to show you how to set up DHCP snooping, but I've covered that once again in this video.
So if you just want to see the dynamic of the inspection part of the video, then jump to the specific
time stamp of interest.
I've included this once again below this video.
This presentation shows you how to set this up, how to verify it on a Cisco switch.
Now, the first thing we need to do is enable the snooping.
Now, I've covered this in a lot of detail in the previous video, so all I'm going to do here is copy
and paste the commands into the switch.
Have a look at this video if you want to look at snooping video that discusses this in a lot of detail.
OK, so what I'm going to do is copy the commands from this presentation and paste the commands on our
switch.
Now in our topology, once again, we've got a Cisco router, this
router is configured with a DHCP server.
So let's review that first.
Here's the router show run pipe begin.
That just allows me to filter the configuration until the keyword DHCP is found.
So there's the command here's my DHCP pool you can see the network used is 10..1.1.0/24 default
router or default Gateway is the local router.
DNS server is set to Google.
The router has this IP address, 10.1.1.254 configured on gigabit 00.
So this interface is configured with the IP address 10.1.1.254 and the routers allocating
IP addresses to devices
and we can see that by typing show IP DHCP binding, we can see that two devices have received IP addresses.
This is the IP address allocated to Kali Linux, this is the IP address allocated to the Windows computer.
We can verify that
by using the command IP address on Kali, notice there's the IP address allocated to the Kali Linux host
and on the Windows computer, I'll open up a CMD prompt IP config.
This is the IP address of the Windows computer.
So the DHCP server has been configured.
It's allocating IP addresses to the devices in the network.
What we need to do now is configure DHCP snooping on the switch.
At the moment, no DHCP snooping has been enabled, so you can see that no DHCP commands have been enabled
and we haven't enabled dynamic ARP inspection.
OK, so the first thing I'm going to do is copy the DHCP snooping commands to the switch.
So I'll paste those in
and you can see here that DHCP snooping has been enabled globally, it's been enabled for VLAN 1,
we've disabled option 82 and the command show IP DHCP Snooping shows us that DHCP snooping is now enabled
on VLAN 1.
No trusted ports have been configured yet.
Now, once again, I've shown you previously how to configure DHCP snooping and I've explained it in
a lot of detail, so I'm not doing that here. OK,
the next step is to configure trusted ports, in my topology
gigabit 00 is a trusted port.
OK, so in my topology gigabit
00 is the interface that connects to the router.
The router is running the DHCP service.
It's allocating IP addresses.
We want to trust this DHCP server.
We don't want to trust this Kali Linux host as a DHCP server.
So back on the switch, I'm going to paste those commands.
Gigabit 00 is now a trusted interface show IP, DHCP Snooping.
We can see that Gigabit 00 is now a trusted interface.
Now we can also rate limit DHCP requests to stop a denial of service attack.
So I'm going to rate limit DHCP messages to 10 packets per second on gigabit 01, which is the
interface connecting me to the Kali Linux host.
Again, I've explained that in a lot of detail in the previous video.
So I'll paste that in.
Got to type conft first, so try that again
there we go.
So show run interface gigabit 00.
We are trusting this interface.
We are not trusting this interface, this interface.
Gigabit 01 is being rate limited.
00 is being trusted.
OK, now that I've configured DHCP snooping, I can configure dynamic ARP inspection.
Dynamic ARP inspection is fairly simple to configure.
What we're going to do is configure it globally on the switch by using the command IP ARP inspection
VLAN 1.
So conft ip arp inspection specify the VLAN.
In my example,
it's VLAN 1 because all ports on the switch are currently configured in VLAN 1.
Now typically in the real world
you wouldn't put your devices in VLAN 1, you would put them in a different VLAN.
Now notice what's happening.
We are already seeing invalid ARP messages received on Gigabit 02.
That is the Windows host.
We are not trusting anyone at the moment.
We are basically blocking all traffic.
So the Windows host is trying to get to its default gateway.
So it's trying to get to 10.1.1.254.
There's the IP address of the Windows host Mac address of the Windows host trying to get to its default
gateway and the traffic is being denied.
We can see that as an example on the Windows PC.
If I try and ping the router, it's not going to work.
Traffic is denied
and actually, let me demonstrate this.
I'm going to remove dynamic ARP inspection, so let's remove
and what you'll notice is the PC, the Windows PC can ping the router.
and it can ping the router. So Kali can ping both the Windows PC as well as the router
and it can ping the router so Kelly can ping both the Windows PC as well as the router.
but as soon as we enable dynamic ARP inspection, we basically break the network because notice traffic
from 10.1.1.2 to 10.1.1.100 is being denied.
Because now when we try and ping, say, the Windows host, the traffic is denied.
Kali is not able to ping the Windows host and it's not able to ping its default gateway, the Windows
host can't get to its default gateway.
That's a problem.
We want it to be able to talk to its default gateway.
So what are we going to do is set gigabit 00 as a trusted port.
That's the port connecting us to the router.
So on the switch interface, gigabit 00 IP ARP inspection.
I'll just use Questionmark again, trust, we're going to trust that interface, so show run interface Gigabit
00.
This command shows us that this interface is trusted for DHCP snooping as well as for ARP inspection.
So now can the Windows PC ping the router? At the moment, we can see that it can't.
We're still getting a whole bunch of denies on the switch show IP DHCP
snooping.
Let's look at the bindings, notice the problem, there are no DHCP bindings at the moment.
We are relying on the DHCP bindings database to implement dynamic ARP inspection.
We need to have the bindings in the database for dynamic ARP inspection to work.
So we constantly getting these deniers at the moment because there is no entry in the DHCP snooping database,
so I'm going to type ipconfig/release to release my IP address
and then I'm going to type renew to renew the IP address on the Windows computer.
It's now been given this IP address back on the switch show, IP DHCP snooping binding.
We can see that this Mac address has been given this IP address and we can see that via DHCP snooping
on VLAN 1.
The interface where that host resides is gigabit 02.
So back on the Windows PC, can it now ping its default gateway? and the answer is yes, it can.
So remember, because we're using the DHCP snooping, the PCs have to request IP addresses and those IP
addresses have to be allocated through DHCP.
We've got to have DHCP snooping, listening in on the conversation, seeing that the router allocates
the IP address to the PC and then because of that, the DHCP snooping databases built and dynamic ARP inspection.
Can you leverage that database to permit devices?
So again, on the switch show IP DGP snooping binding, we can see that this IP address was allocated
to this Mac address on this interface.
Now Kali can stall, not ping the default gateway because
an IP address hasn't been added to the DHCP snooping database, so what I'm going to do is edit connections
in Kali.
I'm going to go to IPv4s settings, disable the interface.
Go back and get it to use DHCP.
Ifconfig
shows us that it's got its IP address.
Show IP DHCP binding on the switch, you can see that this IP address has been allocated to this Mac
address, which is
the Kali Linux host Mac address ends in 5a 00 which is what we see over here.
So on the switch, once again, show IP DHCP snooping binding.
Yes, it can.
So on the switch, once again, show IP snooping binding.
We can see that two IP addresses have been allocated to specific MAC addresses show IP ARP
inspection, so there's the command again, we can see that it's enabled for VLAN 1, so many packets
have been dropped. Now
on Kali, once again, ifconfig shows me that this is the Mac address of the host ending in 5
a 00 ,on the switch show IP DHCP Snooping Database, that MAC address has been allocated this
IP address.
Kali can ping default gateway, once again, that IP address, this MAC address.
Now I'm going to change the Mac address by using Mac changer.
Mac Changer tells us that we can see the Mac address by using S as an option and then we can create
a random Mac address using dash r or hyphen r. So Mac changer -s Ethernet0.
That's the current Mac address.
That's the permanent Mac address scrolling up once again.
That's the Mac address that we saw previously with if config.
So let's create a random Mac address.
Mac address
we've been told is now this.
So ifconfig shows us that that is the new Mac address that we've been given.
Random Mac address.
Can we ping the default gateway?
Answer is no, we can't.
And we're seeing a lot of denies on the switch, you can't just create some random Mac address or try
and implement ARP spoofing or poisoning because we've now got dynamic ARP inspection enabled on the switch.
And I'll just stop the ping on
Kali, the only Mac address that's allowed is that Mac address on Interface Gigabit
01.
This Mac address is permitted on Gigabit 02.
So by randomly changing my Mac address using Mac changer from this address to this address, traffic
is now being denied.
It also stops someone from using an application such as ettercap to poison the ARP caches.
So again, previously I showed you how to use ettercap to poison hosts on the network.
So if I try and scan for hosts now that traffic is going to be denied by the switch because of dynamic
ARP inspection, I can't implement ARP poisoning by using ettercap, unlike previously when I demonstrated
it in this video, because we've got to dynamic ARP inspection enabled.
OK, very long video once again, but hopefully I've shown you clearly how to set up dynamic ARP inspection
and how to test it.
You can once again download this presentation if you want to have a summary of what we've done and you
want to keep this as a reference.