In a sense, ICMP redirect attacks is similar to BGP hijacking where Internet traffic is redirected through a different AS at the enterprise ISP level by rogue BGP routers falsely advertising a better metric route for destination remote networks. This redirection causes the victim hosts to update their routing table and insert “better priority” gateway alternatives through the attacker’s host instead to reach the destination network. Unlike ARP spoofing where the attacker pretends to be the target host in the hopes of getting frames re-directed to them on the LAN, ICMP redirect attacks modify the routing table of victim hosts, by misleading victims that they provide a better metric to the target destination outside the LAN. Now what are ICMP redirect attacks? You can read more about the background here, or pages 13 and 29-30 of this Master’s thesis on MITM attacks. Given the above, it seems the only other MITM attack which is not ARP spoofing is the ICMP redirect attack, a more sophisticated attack which works very different from spoofing MAC addresses with gratuitous ARP broadcasts.

Why, probably because MAC-IP mappings have been hardcoded in the ARP tables.Īt the outset we are given this network layout We’re told a few things up front, namely that to use a man-in-the-middle attack but that the typical MITM method, ARP spoofing doesn’t work.

Python3 scapy mitm