MitM attack causes victim connection loss

[KherKhere]

Hello ,

Exactly i have same problem , i start pinging google.com on victim and time is 200-240 ms . but after i start ettercap MiTM after some sec (4,5 sec ) time Grow up 1200-1600 ms and too much packet lost . it seems something flood Packets ,
also when i try ping Gateway from victim time going to 400 500 ms ( before ettercap it was on 1,2 ms )
can help me how can i check this issue ?

regards .

[oddacon]

considering you have started forwarding network traffic by:

echo 1 > /proc/sys/net/ipv4/ip_forward

and in your etter.conf file removed the # tags.

#redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
#redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

to look like

redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

Consider that running the command:

ettercap -TQM ARP:REMOTE -i eth0 /10.0.0.1/ /10.0.0.2/

will cause the router's arp wathcers to suspend traffic, sometimes from the whole router. Check out YAMAS (http://comax.fr/yamas.php) to see how some of the same commands are used in quiet mode to spoof network traffic without setting off red flags.

[fliprich]

I was experimenting with this setup also today. I noticed that arpspoof poisoning works fine, but when checking the arp table on the victim machine (my iphone), i noticed that the mac address in the table was the one of the host machine that runs my BT vmware station. To confirm that was the issue, I ran wireshark on both my BT VM and the host machine (Win7) while sending packets to the internet (ICMP) from the victim. After analyzing the pcaps, I noticed that the ICMP traffic was being forwarded to the host machine and NOT the Backtrack VM.

This is not an issue when testing from my WinXP VM to my Backtrack VM because they run on the same host machine. It only happens over the physical network.

[ShadowMaster]

Is your adapter bridged or NAT'ed? Because that makes a huge difference in terms of MiTM attacks.

[fliprich]

It's bridged. That's why it was so confusing to me. The BT VM, the host machine (Win7), and the victim (my iphone), were all on the same /24 network.

But i do think the issue is something with the VM itself or the VM adapters on the host machine.