| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <200408061904.VAA26025@trantor.eads-dsn.com> From: yann.fleutot at eads-telecom.com (Fleutot, Yann) Subject: follow up question... I don't see what is so special here. The fact that all communication are routed through the access point is the usual way in the WiFi infrastructure mode. Maybe you should look at the differences between the 2 WiFi modes : infrastructure and ad hoc. For me, the infrastructure mode is the most usual. -----Message d'origine----- De : kyle stapp [mailto:kyle.stapp@...hillgroup.com] Envoy? : vendredi 6 ao?t 2004 15:20 ? : full-disclosure@...ts.netsys.com Objet : [Full-Disclosure] follow up question... Hey there everyone, No answer to the question here...just another one. I caught this and got thinking...I don't know near enough about wireless systems so here's a question in addition to his. Does that really make it more secure(prevent ARP poisoning). Doesn't that make it easier to corrupt the network? How hard would it be to assume the identity of the AP? What happens if two AP's with the same IP and MAC attempt to get on the same network? I been reading and heard a lot more about people infiltrating by setting up their own rouge AP's. If I don't understand this right let me know. I believe from what has been said that this system forces all comunication to be sent to the AP and the AP handles routing it to the true destination. ie Source=192.168.1.34 FE:EF:FA:CE:BE:EF Dest=192.168.1.35 FE:EF:FA:CE:BE:EE AP=192.168.1/255.255.255.0 DE:AD:C0:DE:CA:FE Situation: Source want to send to Dest. Source queries as in previous email...Source sends to DE:AD:CO:DE:CA:FE. AP re-routes this to FE:EF:FA:CE:BE:EE. ----- Original Message ----- From: "Dan Taylor, Jr." < dan.taylor.jr@...il.com <mailto:dan.taylor.jr@...il.com> > To: < full-disclosure@...ts.netsys.com <mailto:full-disclosure@...ts.netsys.com> > Sent: Thursday, August 05, 2004 11:15 PM Subject: [Full-Disclosure] Static ARP Replies? > I have encountered a few 802.11b public access points (I can't > remember the vendors, but they were for hotels) that seem to have > built-in ARP cache poisoning prevention. I found it nonetheless > impressive and am looking for solutions to implement it (presumably > with my own wireless card and hostap drivers). > > Here's what happens on one of these networks: > > Say the AP's MAC address is DE:AD:C0:DE:CA:FE, with the IP of > 192.168.1/255.255.255.0, and I send out an ARP request for hosts > 192.168.1.2-254. > > Say my MAC address is FE:ED:FA:CE:BE:EF, with the IP address of 192.168.1.100 > --> ARP broadcast (source FE:ED:FA:CE:BE:EF destination FF:FF:FF:FF:FF:FF) > --> Who has 192.168.1.2? Tell 192.168.1.100 > > --< ARP Reply (source DE:AD:C0:DE:CA:FE, destination FE:ED:FA:CE:BE:EF) > --< 192.168.1.2 is at DE:AD:C0:DE:CA:FE > > I'm assuming this is a rather effective way of not only preventing ARP > poisoning attacks, but making it so that all communication is > virtually done between the client and the access point). > Has anyone seen this feature implemented in any other access points? > To what extent does this work and/or it's behavior on layer-2 > broadcasting or client to client (mac address to mac address) > communications? > > Thanks. > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html <http://lists.netsys.com/full-disclosure-charter.html> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040806/7af1a7e0/attachment.html
Powered by blists - more mailing lists