Date: Sat, 12 Oct 2002 22:51:55 -0700 From: "Alex Pavlovic" <alex.pavlovic@corp-x.com> To: "FreeBSD Security" <freebsd-security@FreeBSD.ORG> Subject: RE: Kernel log message Message-ID: <OIEDKPDGGBLHDIKAKDABAEALCAAA.alex.pavlovic@corp-x.com> In-Reply-To: <ODEMJJBMDNGMFJHKBCMFGEGHEAAA.ww@austin.rr.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Hi, There is always a possibility of someone or something performing arp manipulation in order to redirect the lan traffic. Some common techniques that come to mind are: MAC spoofing which is efficient against CAM tables found in switches ( If you are running a switched network ) and ARP spoofing / cache poisoning which might apply to you. Attacks that can be performed with these range from sniffing to proxying, MiM, DoS to escaping firewalls. Recently for example certain data has been published about intreception of ssl traffic and attack against Microsoft IE certificates. -- Alex Pavlovic Founder and CTO Corp-X Solutions http://www.corp-x.com > -----Original Message----- > From: owner-freebsd-security@FreeBSD.ORG > [mailto:owner-freebsd-security@FreeBSD.ORG] > Sent: Saturday, October 12, 2002 5:38 PM > To: FreeBSD Security > Subject: Kernel log message > > > Could someone explain to me what the following log message means: > > disco.wwallace.net kernel log messages: > > arp: 192.168.100.2 moved from 00:20:78:0d:5a:7f to > 00:00:78:0d:5a:7f on de0 > > Oct 5 08:03:57 disco /kernel: arp: 192.168.100.2 moved from > 00:20:78:0d:5a:7f to 00:00:78:0d:5a:7f on de0 > > The machine in question (192.168.100.2) is a Windows 2000 machine > that has had the same NIC for years. Also, only one of the digits in the > MAC address seems to have changed. What could cause this? > > Thanks, > - William. > > [-- Attachment #2 --] x>"7 IPM.Microsoft Mail.Note 1 3 > ' # & ) . 6 p Kernel log message q % o VmEm]0 ח K SMTP:ALEX.PAVLOVIC@CORP-X.COM @ :܁|r mC6r$ 8 4 LZFuP rcpg1252 `n033O ch set0 PxPfprqATahq} l ; o05 vIwk d4 `c P c HiN, The @way!H poibity of spe th grm .p u `ti to qi pc@ ra . u m`!h q P " qd e:мAC w 00g qs@CAM#vlu%1 !t( I y`%R )P )%@ twk ) p%@ARP%/" ?! &H pgh'p P p *.vA@ k $Db. $,!)&!q R "! oxy ,iM60Do =.pp "0 p`lls"`R'q0a A' xam P" d 2p u` ,`@ !8a0 s !, 1'6P @IE9 0 1 --1(x Pav c F)B q-BCTOP ->X"q @ #0 tp://wGP.ExGmA; P 0 @36@5#A@0I316BaLzOg @s'eLKJ K i-144@ @8180@ PCb .Fa% bPow r-P bsd- cq `@Q BSD.ORG n[ :RS]oCQa`0:Qtp:py60O!@o2p 60K 5:38C0(UQaTU QSQV$Wh;`j!1X7Ke MH<NO @K`I\Ql%@ 9 S$&$a!r8 U _)?_Q qX0 ! o.'GP7 e.,Q ko^g @ > %1h92.Lp8l P.ZP`v,!4SP: :78:0d:5am mamam Prk3YaK`5mPm3n7oh.@i%klmnoH% .k" !# (Ird) W!U Z!Px$C:%@g!rM"NI%8yg"``8o60 0a u!! M t d!%}d p em1 s"u4dqW$Tc.pu3 s? p1-{8 0mA,Q B 0 <ODEMJJBMDNGMFJHKBCMFGEGHEAAA.ww@austin.rr.com> F F F R 'j F T 9.0 F 6 F 7 F 8 F : F < F = F X F Y F mC6r$ mC6r$ 8 +*V PSTPRX.DLL NITA 7n C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\outlook.pst 47 8 <OIEDKPDGGBLHDIKAKDABAEALCAAA.alex.pavlovic@corp-x.com> =% o e HI,THEREISALWAYSAPOSSIBILITYOFSOMEONEORSOMETHINGPERFORMINGARPMANIPULATIONINORDERTOREDIRECTTHELANTRAF 5
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?OIEDKPDGGBLHDIKAKDABAEALCAAA.alex.pavlovic>