Monitor ARP Traffic on OS X with ArpSpyX
ArpSpyX has just been updated to version 1.2 which adds full support for Intel Macs. If you’re not familiar with ArpSpyX you should give this utility at least a quick look if you care at all about the security or contents of your local network.
The program works by either monitoring ARP (Address Resolution Protocol) traffic or issuing ARP queries. Where DNS maps names to IP addresses (e.g. test.example.com has IP 192.168.1.10), ARP maps IP addresses to the vendor-assigned MAC address of the actual device (so, in the below example, 192.168.1.47 maps to 00:1B:63:D9:CE:09).
Why is ArpSpyX useful? Well, with it you can:
- Actively or passively collect all the MAC & IP addresses of the devices on your network (with the ability to export this data)
- Quickly identify new clients on any network you’re connected to
- See if you are falling prey to ARP Poisoning attacks
The only real downside is that it requires modifying Unix permissions of your network devices, something Allen Porter (the author of ArpSpyX) has identified as a potential improvement.
While you’re tinkering with ArpSpyX, you can learn more about ARP via this helpful About.com page, download the source to ArpSpyX via it’s Google Code home or explore vendor MAC address prefix assignments via this helpful search utility.
Trackbacks/Pingbacks (Trackback URL)
Comments RSSComments
#1 robdew says:Very interesting.
Very buggy.
#2 Allen Porter says:Hi Robdew,
Feel free to file bug reports on the googlecode page and I will investigate any issues you are having.
#3 Nigel Ramsay says:As an alternative to running chmod, instead you can run the app as a superuser:
1. Start Terminal (in Applications / Utilities)
2. Run this:
sudo /Applications/ArpSpyX.app/Contents/MacOS/ArpSpyX
3. It will ask you for your password
4. The app will start and work with the inflated privileges
Leave a reply