Dynamic ARP Inspection: Stop Kali Linux ARP poisoning attacks

DAI is now part of the CCNA 200-301 exam. You need to know both DAI and DHCP Snooping for the new CCNA exam. Kali Linux can be used to implement an ARP poisoning attack which can result in a man-in-the-middle attack to capture passwords. Stop ARP poisoning attacks by implement Dynamic ARP Inspection.

In a previous video I demonstrated how to use Ettercap and Kali Linux to capture usernames and passwords by poisoning the ARP caches of a Windows 10 computer and Cisco router. In this video I'll show you how to stop this type of attack.

ARP spoofing attacks and ARP cache poisoning can occur because ARP allows a gratuitous reply from a host even if an ARP request was not received. After the attack, all traffic from the device under attack flows through the attacker's computer and then to the router, switch, or host.

An ARP spoofing attack can target hosts, switches, and routers connected to your Layer 2 network by poisoning the ARP caches of systems connected to the subnet and by intercepting traffic intended for other hosts on the subnet.

It's so easy to hack badly configured networks using Kali Linux! Ethernet networks rely on protocols such as Address Resolution Protocol (ARP) to function, but they can be easily manipulated using Kali Linux. Make sure you have configured your networks securely! Otherwise, look at how simple it is to hack networks using Kali Linux running on a Windows 10 computer. Applications like Ettercap make hacking with Kali Linux super easy! It's important that you as a network professional know how to protect networks from hackers. Even the new Cisco CCNA 200-301 exam covers some of these hacking topics. Don't just learn the theory of hacking, learn how to hack practically.

In this Ethical Hacking with Kali Linux playlist, I'm going to show you step by step how to hack and protect networks. This is white-hat hacking, not black-hat - in other words this is about teaching you Ethical hacking to help you better secure your networks!

In this video I'll show you how to poison the ARP cache of a Windows 10 computer and then implement a Man in the middle (MITM) attack so you can see all data sent between the Windows 10 computer and it's default gateway. In subsequent videos I'll show you how to hack other protocols.

======================
Menu:
======================
Overview: 0:00
Enable DHCP Snooping: 4:33
Enable and verify DAI: 9:30

======================
Cheatsheet PDF:
======================

======================
Previous Video:
======================

======================
CCNA content:
======================

kali linux
Hacking
Ethical hacking
CompTIA Linux+
CompTIA Security+
CompTIA Network+

EVE-NG
GNS3
VIRL
Packet Tracer
CCNA
Cisco Devnet Associate

CCNP Enterprise
CCNP Security
CCNP Data Center
CCNP Service Provider
CCNP Collaboration
Cisco Certified Devnet Professional
Cisco Certified Network Professional

LPIC 1
LPIC 2
Linux Professional Institute
LX0-103
LX0-104
XK0-004

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

#kalilinux #ccna #kali

[davidbombal]

Menu:
Overview: 0:00
Enable DHCP Snooping: 4:33
Enable and verify DAI: 9:30

Cheatsheet PDF:


Previous Videos:



CCNA content:

[alexanderastardjiev]

Hi David, great video. I have few suggestions :
- Stop using "ifconfig" command. It is actually deprecated long, long time ago. Since lots of people that are getting started with Linux will learn from your videos it will be useful for them to create habit to use the new "ip" command instead.
- You can use the "/sbin/dhclient" command to release and renew without disabling the interface. The benefit is if you use the "-v" (for verbose) will show what are the actual DHCP packets exchanged between the host and the dhcp server, which could be interesting for someone learning the basics.

[Zerback]

Just studying for the Sec+ certification and this is great David. Congrats for the Million subs too!! BTW, cant wait to see some deep dive with Chris Greer!

[mortenbjerremannnielsen]

You are an awesome teacher, David. Thanks for another great video!

[Torcheban]

Cisco should use your video in CCNA Security course:)

[SantiagoRebella]

Great explanation of the DHCP snooping process and DAI. Thanks :D

[KrishnenduBiswas]

Thank you Sir for uploading this kind of stuff. Really helpful for us.

[klonxful]

Thank you sir, with this video i can truly understood what is the D. arp inspection.

[rodrigosalvadorbr]

Thanks so much for the wonderful content!

[vejamoxdan]

I implemented a partner network, configured with a lot of routers. The default gateway of those routers was a firewall. We separated the trafffic using private-vlans to prevent lateral movement. It was working like a charm until a damn partner configured our own ip on his router, causing a hugh problem of connectivity to all other partners. My solution was configuring DAI, attaching the mac -address and ip of our firewall to a mac ACL. Now, when someone has the brillant idea to use my firewall's ip, the DAI blocks those attempts.

[gtotrips]

To: David Bombal
Re: It looks like there’s a typo in this video’s explanation where it says DAI starts at 9:30, it should be 9:00 or 9:03...

Best Regards,
Dave Larkins

[yogesh]

Hi David Sir,
I really love all your videos.
Why don't you teach CCNA Security or are you going to launch this course in future?

[whitewolf]

Thank you so much man. Great tutorials!

[wdpwr]

Nice vid there ! For a regular commercial router/un managed switch user how can you protect against arp poisoning ? Xarp can do the job at some low lvl MITM attack without macchanging but as we all know when u become a target you can expect more than a script kiddie ;) on the mobile devices it is even harder to spot and defend against eviltwin combined with MITM specially in public places as airports, ur a sitting duck. Any thoughts on this David ? Thx in advance !

[mareknieznany]

great. So switch has taken binding table from router yes? Moreover we should enable arp inspection only after assigned IP addresses?

[jonasfinnhult]

Great instruction David, thanks!

I wonder how do you tackle the Dynamic MAC Addressing that is now often used in Windows, OSX, iOS and Android?

Cheers/
Jonas

[NeroNORirl]

ARP PSN attack was funny to use in my school 15 years ago. Nobody knew wtf i did at the time and i learned a ton. Other things i had a lot of fun with was telnet and how open printers and faxes was. I guess it wasn't much of a big deal at that time, like it would have been nowdays. At the time i remember using CainAndAble and Wireshark for sneaking around. Take notes people, crypt your traffic on public hotspots ;-)

Another thing we messed with was netsend at that time. Horrible security on the school servers to have this option open for everyone. So we looped a netsend message with a .bat - Bad idea, got in trouble for that one. They claimed i "made a virus". Good old teen days when you get in some trouble haha.

[sne]

Hi David
If we enable Port security and ip source guard on the switch, is it necessary to enable ARP inspection?

[_World_of_Music]

Hi David,
What happens post changing the MAC on Kali and we did ip release and renew? Will it get IP from DHCP with new MAC??

[profreseaux]

What is the best method to save the DHCP binding database in case of a switch reboots?