MiTM Attack? How to detect

[t-alla]

I have been sniffing my network with wireshark and ettercap but cant find an attacker. I have my arp set static because I was being arp poisoned but setting it static fixed the problem for a little while. Now my websurfing is real slow and hessitates a lot. Also sometimes my downloads just seem to freeze. I know something malicious is going on but I need proof to bring to my superiors. I'm sure this is being done intentionally by someone else in my IT dept. What tools do you suggest I can use in BT4 and what should I look for. Like I said I dont see anything in ettercap or wireshark out of the ordinary other then the gateway broadcasting every so often? I could really use some help here guys

[grancerote]

hi

you should be more specific with your question about which method is he using if there is a real person on the background of this.

for me looks like you have virus than someone in your PC cuz Wireshark doesnt show anything.

so if you cant find it FORMAT

lol

[thorin]

If you have a problem with you machine that you can't fix you should probably call your helpdesk or follow whatever process you company has setup to deal with such issues.

[streaker69]

I have been sniffing my network with wireshark and ettercap but cant find an attacker. I have my arp set static because I was being arp poisoned but setting it static fixed the problem for a little while. Now my websurfing is real slow and hessitates a lot. Also sometimes my downloads just seem to freeze. I know something malicious is going on but I need proof to bring to my superiors. I'm sure this is being done intentionally by someone else in my IT dept. What tools do you suggest I can use in BT4 and what should I look for. Like I said I dont see anything in ettercap or wireshark out of the ordinary other then the gateway broadcasting every so often? I could really use some help here guys

I can think of several things that could be causing that other than someone behaving maliciously. Contact your helpdesk and have someone stop out and see if there's something really wrong.

[Barry]

If I found someone stupid enough to be running wireshark on one of my computers their ass would be on the street so damn fast they'd get whiplash. We'd mail them their personal effects.

[t-alla]

I dont have a virus...i'm running a dervative of gentoo! Also my machine works perfectly everywhere else so the problem is on this LAN at work. I dont need to call help desk because I'm the netadmin and I know my system and my network and there is nothing wrong with how it is configured. Does anybody have anything helpful to say? Also why would I have to have my arp set static only at work but no where else? There is something malicious going on and I'm asking for help. Is arp poisoning or session hijacking really that easy to spot? Should I be able to see it immediatly with ettercap plain as day...and what is wrong with wireshark? What tools do you recommend I use to see what is going on?

[imported_vvpalin]

I know something malicious is going on but I need proof to bring to my superiors.

Just go show them what you have been doing, thats all the proof they need.

[t-alla]

So I had wireshark and ettercap running all day and ettercap reported "ettercap plugin banshee killed connection" now how do I find the source? I dont see any tcp resets on wireshark but I do see icmp unreachables.

[imported_K____]

Maybe you should use iptables in order to filter incoming connections.
Set "drop" rule for all incoming connections from local network except for gateway or router, static ARP, and find out if the problem still exists.

[t-alla]

Thats a good idea K! Why didn't I think of that

I'll give it a try on monday and let you know how it turns out