Detect ARP spoofing with Malcolm

[tbfhg]

Hi there,

is it possible to detect ARP spoofing with Malcolm? We would like to demonstrate ARP spoofing and detection for educational purposes. Therefore we are spoofing the mac addresses of two known devices in a training environment. Is there an option to define suricata or zeek rules to detect the mismatch of mac and ip? Currently it seems that ARP messages can not be detected or seen in the dashboards or arkime.

P.S.: I originally posted this question in r/Malcolm.

[mmguero]

At the moment Malcolm doesn't do any logging ARP traffic at all.

There's actually a parser for an OT protocol call ethercat that has sort of a side effect of logging all arp traffic, although we disable that as it usually ends up being just a huge volume of logs. If you wanted to try turning that back on to see if that would help you, you could edit your local ./zeek/config/local.zeek file, disable that section, and then bind-mount local.zeek into your docker-compose.yml file (here's an example of what that would look like, you'd need to do it for both zeek and zeek-live services).

As far as detecting the mismatch of MAC and IP, I'm not exactly sure how you could do that: for example, when a router or NAT device forwards a packet, it typically replaces the source MAC address with its own MAC address for the outgoing segment. How would you tell the difference? But I'm a coder not an analyst, so maybe somebody else would have a better idea than me.

[tbfhg]

So you are right about the router issue. But this situation only occurs, when the traffic is sent in another subnet.
We are using only local subnet traffic. So one question regarding this MAC/IP mismatch: When the assets are maintained in netbox, would Malcolm detect the mismatch and raise an alert?

[mmguero]

No, I'm afraid it doesn't. At the moment the only thing the MAC addresses are used for with regards to NetBox is attempting to identify the hardware manufacturer.

[tbfhg]

Ok, I think we will work on this topic in the up coming weeks and I will update this thread when we've got a solution.