views:

286

answers:

2

Hi there!

Is there a way a send custom (and event undemanded) arp responses via shell (e.g. by hand or by a shell script) on MacOS X or any other UNIX? In addition, is there a way of making the software ask for the MAC representation for all IPs in the current subnet without sending pings the anyone?

Thanks, Max

+1  A: 

A packet generator might do the trick. The wikipedia page links to some implementations but I don't know if they work on OSX.

João da Silva
+3  A: 

Yes there is. This kind of activity is used in ARP Spoofing and ARP Poisoning attacks and is preformed for ex. by arpspoof. If You want to discover host's MAC, when You know its IP and it is located in Yours broadcast domain (LAN), use arping. ARP is layer 2 protocol, so it's packets are not forwarded by routers but it's much more reliable then ICMP echo (ping).

Some tools:

  • arp - standard program (win/unix) used to list host's IP-MAC address association cache, which contains already learnt IPs

  • arping - unix program which sends ARP Request for a given IP and displays MAC contained in received ARP Response

  • arpspoof - a program from dsniff package generating bogus ARP Responses

Jacek Ławrynowicz