ARP0c is a connection interceptor (using ARP spoofing and a bridging engine).
ARP requests from various sources in a switched environment get false ARP response packets which point to the host running ARP0c. Packets from these hosts are bridged with an internal engine to the real destination address to allow normal network operation and keep TCP connections alive. Packets to hosts in remote (read: reachable using a router) subnets are forwarded to a gateway using an internal routing table - independant from the hosts routing table.
Normal operation without interception may look like this:
+--------+ +--------+ +-------+ | HOST1 |- - - - -+ SWITCH +- - - - -| HOST2 | +--------+ +--------+ +-------+ | | ********* * YOU * <-- this host gets no packets *********Here you sit on a switched network, just getting ARP requests and other kinds of broadcasts without seeing any interesting packet. This is what a switch is supposed to do.
+--------+ +--------+ +-------+ | HOST1 |- - - - .+ SWITCH +. - - - -| HOST2 | +--------+ \--------/ +-------+ \ | / \ | / ********* * ARP0c * <-- this host gets all packets *********The fact that most systems use an initially received Ethernet frame as source for the ARP cache entry leads to one-way interceptions, where one of the communication partners sends the frames already to ARP0c and the other still uses the real ethernet address. This is not a problem because by the time the cache expires the other direction is intercepted too. In the UN*X version, you may just create a seperate file to intercept the connection anyway.
You need a libpcap installed.
Then create a file for your local routing table. Separate network, netmask and gatway by tab. You don't have to add the local subnet to this file - it is filled in automatical.
network netmask gateway Example: 192.168.3.0 255.255.255.0 192.168.1.1 0.0.0.0 0.0.0.0 192.168.1.1
host1 host2Finally, call the program:
./ARP0c -i < interface > -r < routingtable.file > -a < agressive_intercept.file > Example: ./ARP0c -i eth0 -r routes.txt -a server.txt -v
192.168.1.0 255.255.255.0 0.0.0.0 0.0.0.0 0.0.0.0 192.168.1.1Make sure you don't have spaces before the first or after the last entry and you should prevent empty lines.