If you have such a small window (but you know when it is, that's a good thing!) just ping one of the hosts that go down and then see what MAC address comes up instead of the right one.
Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 “Success is not final, failure is not fatal: it is the courage to continue that counts.” --- Winston Churchill On Thu, Apr 15, 2010 at 3:49 PM, Forbes Mercy <forbes.me...@wabroadband.com>wrote: > We have the same thing happening every morning this week (always between > 8:53 to 9:15AM), it takes down two to four towers, all mikrotik > (figures). Wireshark has been inconclusive so upon the advice here I > installed arpwatch. As far as I can see arp requests, but not arp > responses, and only broadcast udp or tcp packets. The latter 2 are not > something that arp watch will tell you about though. If it's arp > traffic I need as a response and this program won't help what can be > done about that? > > Forbes > > On 4/14/2010 8:49 PM, Charles Hooper wrote: > > If you find out which MAC is the "offender" you can follow your > > bridging/MAC address tables back to the source of the chaos. It's > > possible that the MAC is spoofed, as well, but you should at least be > > able to figure out a general idea of which AP the attacks are coming in > > from. > > > > You can find out which MAC is doing this either by running a sniffer or > > running a piece of software on the bridge called "arpwatch" > > > > Hope this helps! > > > > Regards, > > Charles Hooper > > > > > > tfad...@coastinet.com wrote: > > > >> H E L P ! > >> > >> I need help, I am one of those people who SOMEDAY is going > >> to implement a routed network. I am now suffering from > >> hackers ARP spoofing and bringing down customers, parts of > >> my network and "man in the middle" attacks. I am the man in > >> the middle, so they can capture my passwords! > >> > >> I have about 700 subscribers on a one bridge network. I > >> need help stopping the attacks and then help with > >> implementing a routed network that can be managed and find > >> mischievous customers in the future. > >> > >> I do not have this expertise and looking for help. > >> > >> tfad...@yahoo.com > >> > >> > >> > >> > >> > -------------------------------------------------------------------------------- > >> WISPA Wants You! Join today! > >> http://signup.wispa.org/ > >> > -------------------------------------------------------------------------------- > >> > >> WISPA Wireless List: wireless@wispa.org > >> > >> Subscribe/Unsubscribe: > >> http://lists.wispa.org/mailman/listinfo/wireless > >> > >> Archives: http://lists.wispa.org/pipermail/wireless/ > >> > >> > > > > > > > -------------------------------------------------------------------------------- > > WISPA Wants You! Join today! > > http://signup.wispa.org/ > > > -------------------------------------------------------------------------------- > > > > WISPA Wireless List: wireless@wispa.org > > > > Subscribe/Unsubscribe: > > http://lists.wispa.org/mailman/listinfo/wireless > > > > Archives: http://lists.wispa.org/pipermail/wireless/ > > > > > > > > > -------------------------------------------------------------------------------- > WISPA Wants You! Join today! > http://signup.wispa.org/ > > -------------------------------------------------------------------------------- > > WISPA Wireless List: wireless@wispa.org > > Subscribe/Unsubscribe: > http://lists.wispa.org/mailman/listinfo/wireless > > Archives: http://lists.wispa.org/pipermail/wireless/ > -------------------------------------------------------------------------------- WISPA Wants You! Join today! http://signup.wispa.org/ -------------------------------------------------------------------------------- WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
