Search code examples
c#network-programmingadministrationarpspoofing

ARP Spoofing in C#


I am re-writing this because my last one (which I deleted) wasn't explained properly.

So, I am currently making a Network Administration tool for my school, as a self-given homework task (I am bored).

It currently has the following tools:

  • IP address ping tool
  • NSLookup tool
  • Traceroute tool
  • Geo-Location tool
  • ARP spoofing tool
  • Node kicker
  • Remote administration tool creator

I have not started any of these, but I though that I would get the hardest one out of the way first (ARP Spoofing).

I have set up the design; It has - IP address input - A button to start and stop spoofing - IP Address and MAC Address labels - A DataGridView, which has a Connection column, Packets (In) column, Packets (Out) column, and a MAC address column.

The only thing left is the code..

But, I want to know how I could do this in Visual Studio, using C#.

Will I need a specific dll?

What process would I have to go through to achieve this goal?


Solution

  • I get the impression that you really don't understand how network protocols work.

    On a LAN, traffic destined to the local LAN is delivered by MAC address, and it never goes through a router. Only traffic destined to a different network goes through the router. so even if you could capture all the outbound router traffic, you would not capture the traffic sourced and destined on the LAN, nor would you capture inbound router traffic.

    Then, you have the problem of switching on the LAN. Switches are transparent devices; they do not maintain ARP tables, nor do they look at IP addresses. Switches maintain MAC address table that have the MAC addresses, and on which interface the MAC address was last seen. If two hosts send traffic with the same source MAC address, the last one to send will get the next traffic destined for that MAC address. This will cause the MAC address table to constantly change, completely destroying any traffic destined to that MAC address.

    What you propose will not work correctly. What you seem to want to do is to set up a SPAN interface on a switch to mirror traffic to your application.


    Edit:

    You keep changing the question, and you even deleted your first question on this. The real way to do what you seem to want to do with your application is to create an agent for the hosts on the network. This is what most commercial applications do. Network protocols are not designed for discovering devices on the network. On the contrary they are usually designed for security and privacy. There are other protocols designed to fill the holes that would let your application work. For instance, there are many network switches that support things like Private VLANs, and a host on a private VLAN cannot see or communicate with any other host on the same VLAN.