Arp Storm (Cyber Talents)

cybertalents

An attacker in the network is trying to poison the arp table of 11.0.0.100, the admin captured this PCAP.

After you download the pcap file, we will open it on Wireshark :

It’s like a big puzzle .

We will notice that the only change here is the opcode field :

So tshark will be used, we will download it as follows, also you can use — help , To know more .

You will find that Input file:\  -r , — read-file

tshark -r ARP+Storm.pcap

You must now output the different numbers individually ,I tried to use the cut command, but it did not work, so after searching :

$ tshark -r ARP+Storm.pcap -Tfields -e arp.opcode | awk ‘{printf(“%c”,$1)}’

The command you provided captures and analyzes ARP packets from the file ARP+Storm.pcap. It then uses the tshark tool to print the opcode of each ARP packet to the console.

Here’s a breakdown of the command:

tshark : This is a command-line tool for capturing and analyzing network traffic.\ -r ARP+Storm.pcap : This specifies the file to read the captured traffic from. In this case, it’s called ARP+Storm.pcap.\ -Tfields : This tells tshark to print the output in a field-based format.\ -e arp.opcode: This specifies the field to print from the captured packets. In this case, it’s the ARP opcode.\ awk ‘{printf(“%c”,$1)}’ : This uses the awk tool to process the output from tshark.

It takes the first field of each line (which is the ARP opcode) and prints it as a single character.\ The output of the command is a string of characters, each representing the opcode of an ARP packet. The most common opcodes are:

1: Request\ 2: Reply\ 3: RARP Request\ 4: RARP Reply\ In the case of an ARP storm, you would expect to see a large number of 1 characters (requests) in the output. This is because the attacker is flooding the network with ARP requests, which can cause network performance problems.

We will also use https://cyberchef.org/

Here we have reached the correct conclusion in the end .

Here we are done, see you in other reports…!

See you later, bro

Abdelwahab_Shandy

AS_Cyber