Member Avatar for tony75

Hi

How can I find IP and MAC address of attacker and victims from .pcap , which is capture from a man-in-the-middle attack!(IT-forensics).

I will be very thankful for your ansewr!

  • 2 Contributors
  • 2 Replies
  • 236 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by tony75

Dani AI

Generated

Short, practical workflow for a Wi‑Fi MITM .pcap (context: reported the capture came from a Wi‑Fi point). As suggested, start by comparing who is claiming an IP on the wire to what the legitimate AP/router actually advertises. The most reliable signals inside a pcap are ARP activity, DHCP bindings, and 802.11 management frames (beacons/association/deauth). MACs can be trivially spoofed, so always corroborate pcap findings with router/DHCP logs and device ARP tables.

Concrete steps to follow:

  • Confirm link layer: check the first packet to see if frames are Ethernet or 802.11 (monitor/radiotap). Field names differ (Ethernet uses eth.*, Wi‑Fi uses wlan.*).
  • List talkers: use Wireshark Statistics → Endpoints and Conversations to find top MACs and IPs. Note MACs that suddenly start answering ARP for another host’s IP.
  • Inspect ARP: filter ARP traffic to find replies that map a victim IP to multiple MACs, or gratuitous ARP. Check timestamps to see when the mapping changed.
  • Correlate with DHCP: filter bootp/dhcp to find which MAC was assigned which IP at lease time—this ties a MAC to a client identity.
  • Check 802.11 management: look for beacon frames and duplicate SSIDs with different BSSIDs (evil‑twin). For monitor captures, prefer wlan.ta/wlan.sa fields to identify transmitter vs. source addresses.

Useful filters and quick commands:

# Wireshark display filters
arp
arp.opcode == 2
arp and arp.src.proto_ipv4 == arp.dst.proto_ipv4    # gratuitous ARP
bootp || dhcp
ip.addr == 192.168.1.5
eth.addr == 00:11:22:33:44:55
wlan_mgt.ssid == "SSIDName"                         # beacons for a given SSID

# tshark (Ethernet capture)
tshark -r capture.pcap -T fields -e eth.src -e eth.dst -e ip.src -e ip.dst | sort | uniq -c | sort -nr

Caveats and next steps: encrypted Wi‑Fi payloads hide IP/ARP unless the 4‑way handshake and keys are available for decryption. MACs are easily spoofed or proxied by an AP, so pcap evidence should be corroborated with DHCP/router logs, endpoint ARP caches, and timestamps before treating any single MAC as definitive proof of who controlled the traffic. Preserve the original pcap and relevant logs for any formal investigation.

Member Avatar for ActingRude

Under what condition do you suspect this mitm attack? if its a fake router or wifi point then comparing where your packet is comming from to where your router/modem claims it is comming from would be the easiest way. Otherwise there is no great catch-all for this attack.

Member Avatar for tony75

Hi sir thanks for answer, itwas from wifi point.
Can you explain more please how can I find the ip of attacker?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.