[ previous ] [ next ] [ threads ]
 From:  Lee Sharp <leesharp at hal dash pc dot org>
 To:  "m0n0wall at lists dot m0n0 dot ch" <m0n0wall at lists dot m0n0 dot ch>
 Subject:  Re: [m0n0wall] Anti netcut (was Re: [m0n0wall] m0n0wall 1.3b17)
 Date:  Wed, 29 Apr 2009 08:21:12 -0500
rgreiner wrote:

> Hi, does somebody know any interesting reference page explaining what
> exactly netcut does and how? All pages I could find speak about
> downloading netcut or anti netcut. I'm interested in neither. What I
> would like is to know how to detect and trace someone using that thing
> in my network, so I could properly "deal" whith this individual.

Actually, tracking is easy.  Look at the arp table on any system on the 
flat network.  If one mac address is constantly advertising itself as 
several IP addresses, they are probably arp poisoning. (Or a bridge, 
wireless range extender, or something else that is supposed to arp for 

But I can not see how he is protecting the network.  It might protect a 
single system, but not a network.