Page 1 of 1
Does the internal virtual switch ignore ARPs?
Posted: 17. Apr 2011, 20:57
by scuba7183
Hi, I'm trying to emulate a man-in-the-middle attack for a college security class. I have 3 ubuntu 10.10 guests running in a windows 7 host running VBox 4.0.4. When running ettercap in one of the guests, it's ARP poisoning does not seem to be working.
Re: Does the internal virtual switch ignore ARPs?
Posted: 17. Apr 2011, 21:53
by Sasquatch
Odd, I have done a lab situation to test Windows 2008 R2 with RRAS VPN and Windows 7 and Ubuntu as clients. When I ran tcpdump, I did see ARP requests. Perhaps your arp poisoning isn't working.
Re: Does the internal virtual switch ignore ARPs?
Posted: 18. Apr 2011, 07:30
by Technologov
AFAIK the internal switch is actually internal hub.
Re: Does the internal virtual switch ignore ARPs?
Posted: 19. Apr 2011, 04:44
by BillG
Sasquatch wrote:Odd, I have done a lab situation to test Windows 2008 R2 with RRAS VPN and Windows 7 and Ubuntu as clients. When I ran tcpdump, I did see ARP requests. Perhaps your arp poisoning isn't working.
I agree. I have Network Monitor 3.4 running on a virtual machine in an internal network and it sees all traffic including ARP requests.
Re: Does the internal virtual switch ignore ARPs?
Posted: 19. Apr 2011, 07:42
by BillG
Screenshot of ARP request on internal network.
ARPonInternal.PNG