ettercap and Squid Proxy

[KherKhere]

Hi dear,

i have one question , if my squid server is in other vlan , for example my clines ip address is 192.168.2.1/24 and gatway is 192.168.1.1 but my Squid proxy server ip is in 192.168.2.1 and client can access to internet just through proxy .
now if attacker is in Clients Vlan , Ettercap will be work or no?

Thanks .

[daedalus1776]

ARP packets won't travel across different subnets. So no. However are you sure it's 192.168.2.1/24 and not 192.168.1.1/23?
Even so, it depends what you want to do ARP cache poisoning on. You can poison route the proxy and the client. It doesn't HAVE to be the gateway.
Furthermore, check this out: http://www.oxid.it/downloads/apr-intro.swf
It has almost everything you need to know

[KherKhere]

Thank You . Very nice flash file for arp Poison , yes i got mistake . My Clients ip Address is : 192.168.1.1/24 and Gateway is 192.168.1.1 and attacker ip is 192.168.1.5/24 . But my Squid Proxy server ip address is 192.168.2.1/24 and its on other Vlan .
after i run Ettercap i just see Authentication Clients from Active Directory , and i not see any Traffic internet on ettercap , is this Because my Squid is in other Vlan ?

[daedalus1776]

yep. Like I said ARP packets won't travel accross different subnets or VLANs. You're sending malformed ARP packets to the two machines you want to poison.. Kinda hard to poison a machine if it's impossible to send the packet required over to it