您好,感謝學長,再請教:
以下我的用 wireshark 擷取資料中的 D-LINKin_df:9e:c2 根本不是區網中的真正 gateway(分享器)
,其冒用了 192.168.0.1 的 IP,並回覆我錯誤 MAC 位址來影響我的 ARP TABLE ...
我擷取了約 1 個多小時不斷重複這些 request/reply 動作...還是說我自己中毒了呢?
我得先確定的是:
1. 是有惡鄰在攻擊(能憑下方 wireshark 的擷取資料認定有第三者在搗亂)
OR
2. 是我自己中毒,結果我才是攻擊者...這樣攤牌時多不好意思..(但先前用 avira free 掃過一遍了)
...可做定論嗎?
=================================================
No. Time Source Destination Protocol Length Info
8 0.000562000 D-LinkIn_df:9e:c2 AsustekC_50:60:e9 ARP 60 192.168.0.1 is at 78:54:2e:df:9e:c2
Frame 8: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Interface id: 0 (\Device\NPF_{8C870860-41BC-4FFE-9EFF-F23B18E4B432})
Encapsulation type: Ethernet (1)
Arrival Time: Sep 20, 2015 21:56:52.253064000 台北標準時間
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1442757412.253064000 seconds
[Time delta from previous captured frame: 0.000131000 seconds]
[Time delta from previous displayed frame: 0.000131000 seconds]
[Time since reference or first frame: 0.000562000 seconds]
Frame Number: 8
Frame Length: 60 bytes (480 bits)
Capture Length: 60 bytes (480 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: D-LinkIn_df:9e:c2 (78:54:2e:df:9e:c2), Dst: AsustekC_50:60:e9 (00:1d:60:50:60:e9)
Destination: AsustekC_50:60:e9 (00:1d:60:50:60:e9)
Address: AsustekC_50:60:e9 (00:1d:60:50:60:e9)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: D-LinkIn_df:9e:c2 (78:54:2e:df:9e:c2)
Address: D-LinkIn_df:9e:c2 (78:54:2e:df:9e:c2)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: ARP (0x0806)
Padding: 000000000000000000000000000000000000
[Duplicate IP address detected for 192.168.0.1 (78:54:2e:df:9e:c2) - also in use by bc:14:01:96:11:e1 (frame 3)]
[Frame showing earlier use of IP address: 3]
[Expert Info (Warn/Sequence): Duplicate IP address configured (192.168.0.1)]
[Duplicate IP address configured (192.168.0.1)]
[Severity level: Warn]
[Group: Sequence]
[Seconds since earlier frame seen: 0]
Address Resolution Protocol (reply)
Hardware type: Ethernet (1)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (2)
Sender MAC address: D-LinkIn_df:9e:c2 (78:54:2e:df:9e:c2)
Sender IP address: 192.168.0.1 (192.168.0.1)
Target MAC address: AsustekC_50:60:e9 (00:1d:60:50:60:e9)
Target IP address: 192.168.0.23 (192.168.0.23)
